security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <[email protected]>
   7  *            Chris Vance, <[email protected]>
   8  *            Wayne Salamon, <[email protected]>
   9  *            James Morris <[email protected]>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <[email protected]>
  13  *                                         Eric Paris <[email protected]>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <[email protected]>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <[email protected]>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <[email protected]>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 #define SB_TYPE_FMT "%s%s%s"
  98 #define SB_SUBTYPE(sb) (sb->s_subtype && sb->s_subtype[0])
  99 #define SB_TYPE_ARGS(sb) sb->s_type->name, SB_SUBTYPE(sb) ? "." : "", SB_SUBTYPE(sb) ? sb->s_subtype : ""
 100
 101 extern struct security_operations *security_ops;
 102
 103 /* SECMARK reference count */
 104 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 105
 106 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 107 int selinux_enforcing;
 108
 109 static int __init enforcing_setup(char *str)
 110 {
 111         unsigned long enforcing;
 112         if (!strict_strtoul(str, 0, &enforcing))
 113                 selinux_enforcing = enforcing ? 1 : 0;
 114         return 1;
 115 }
 116 __setup("enforcing=", enforcing_setup);
 117 #endif
 118
 119 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 120 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 121
 122 static int __init selinux_enabled_setup(char *str)
 123 {
 124         unsigned long enabled;
 125         if (!strict_strtoul(str, 0, &enabled))
 126                 selinux_enabled = enabled ? 1 : 0;
 127         return 1;
 128 }
 129 __setup("selinux=", selinux_enabled_setup);
 130 #else
 131 int selinux_enabled = 1;
 132 #endif
 133
 134 static struct kmem_cache *sel_inode_cache;
 135
 136 /**
 137  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 138  *
 139  * Description:
 140  * This function checks the SECMARK reference counter to see if any SECMARK
 141  * targets are currently configured, if the reference counter is greater than
 142  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 143  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 144  * policy capability is enabled, SECMARK is always considered enabled.
 145  *
 146  */
 147 static int selinux_secmark_enabled(void)
 148 {
 149         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 150 }
 151
 152 /**
 153  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 154  *
 155  * Description:
 156  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 157  * (1) if any are enabled or false (0) if neither are enabled.  If the
 158  * always_check_network policy capability is enabled, peer labeling
 159  * is always considered enabled.
 160  *
 161  */
 162 static int selinux_peerlbl_enabled(void)
 163 {
 164         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 165 }
 166
 167 /*
 168  * initialise the security for the init task
 169  */
 170 static void cred_init_security(void)
 171 {
 172         struct cred *cred = (struct cred *) current->real_cred;
 173         struct task_security_struct *tsec;
 174
 175         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 176         if (!tsec)
 177                 panic("SELinux:  Failed to initialize initial task.\n");
 178
 179         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 180         cred->security = tsec;
 181 }
 182
 183 /*
 184  * get the security ID of a set of credentials
 185  */
 186 static inline u32 cred_sid(const struct cred *cred)
 187 {
 188         const struct task_security_struct *tsec;
 189
 190         tsec = cred->security;
 191         return tsec->sid;
 192 }
 193
 194 /*
 195  * get the objective security ID of a task
 196  */
 197 static inline u32 task_sid(const struct task_struct *task)
 198 {
 199         u32 sid;
 200
 201         rcu_read_lock();
 202         sid = cred_sid(__task_cred(task));
 203         rcu_read_unlock();
 204         return sid;
 205 }
 206
 207 /*
 208  * get the subjective security ID of the current task
 209  */
 210 static inline u32 current_sid(void)
 211 {
 212         const struct task_security_struct *tsec = current_security();
 213
 214         return tsec->sid;
 215 }
 216
 217 /* Allocate and free functions for each kind of security blob. */
 218
 219 static int inode_alloc_security(struct inode *inode)
 220 {
 221         struct inode_security_struct *isec;
 222         u32 sid = current_sid();
 223
 224         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 225         if (!isec)
 226                 return -ENOMEM;
 227
 228         mutex_init(&isec->lock);
 229         INIT_LIST_HEAD(&isec->list);
 230         isec->inode = inode;
 231         isec->sid = SECINITSID_UNLABELED;
 232         isec->sclass = SECCLASS_FILE;
 233         isec->task_sid = sid;
 234         inode->i_security = isec;
 235
 236         return 0;
 237 }
 238
 239 static void inode_free_security(struct inode *inode)
 240 {
 241         struct inode_security_struct *isec = inode->i_security;
 242         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 243
 244         spin_lock(&sbsec->isec_lock);
 245         if (!list_empty(&isec->list))
 246                 list_del_init(&isec->list);
 247         spin_unlock(&sbsec->isec_lock);
 248
 249         inode->i_security = NULL;
 250         kmem_cache_free(sel_inode_cache, isec);
 251 }
 252
 253 static int file_alloc_security(struct file *file)
 254 {
 255         struct file_security_struct *fsec;
 256         u32 sid = current_sid();
 257
 258         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 259         if (!fsec)
 260                 return -ENOMEM;
 261
 262         fsec->sid = sid;
 263         fsec->fown_sid = sid;
 264         file->f_security = fsec;
 265
 266         return 0;
 267 }
 268
 269 static void file_free_security(struct file *file)
 270 {
 271         struct file_security_struct *fsec = file->f_security;
 272         file->f_security = NULL;
 273         kfree(fsec);
 274 }
 275
 276 static int superblock_alloc_security(struct super_block *sb)
 277 {
 278         struct superblock_security_struct *sbsec;
 279
 280         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 281         if (!sbsec)
 282                 return -ENOMEM;
 283
 284         mutex_init(&sbsec->lock);
 285         INIT_LIST_HEAD(&sbsec->isec_head);
 286         spin_lock_init(&sbsec->isec_lock);
 287         sbsec->sb = sb;
 288         sbsec->sid = SECINITSID_UNLABELED;
 289         sbsec->def_sid = SECINITSID_FILE;
 290         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 291         sb->s_security = sbsec;
 292
 293         return 0;
 294 }
 295
 296 static void superblock_free_security(struct super_block *sb)
 297 {
 298         struct superblock_security_struct *sbsec = sb->s_security;
 299         sb->s_security = NULL;
 300         kfree(sbsec);
 301 }
 302
 303 /* The file system's label must be initialized prior to use. */
 304
 305 static const char *labeling_behaviors[6] = {
 306         "uses xattr",
 307         "uses transition SIDs",
 308         "uses task SIDs",
 309         "uses genfs_contexts",
 310         "not configured for labeling",
 311         "uses mountpoint labeling",
 312 };
 313
 314 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 315
 316 static inline int inode_doinit(struct inode *inode)
 317 {
 318         return inode_doinit_with_dentry(inode, NULL);
 319 }
 320
 321 enum {
 322         Opt_error = -1,
 323         Opt_context = 1,
 324         Opt_fscontext = 2,
 325         Opt_defcontext = 3,
 326         Opt_rootcontext = 4,
 327         Opt_labelsupport = 5,
 328         Opt_nextmntopt = 6,
 329 };
 330
 331 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 332
 333 static const match_table_t tokens = {
 334         {Opt_context, CONTEXT_STR "%s"},
 335         {Opt_fscontext, FSCONTEXT_STR "%s"},
 336         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 337         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 338         {Opt_labelsupport, LABELSUPP_STR},
 339         {Opt_error, NULL},
 340 };
 341
 342 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 343
 344 static int may_context_mount_sb_relabel(u32 sid,
 345                         struct superblock_security_struct *sbsec,
 346                         const struct cred *cred)
 347 {
 348         const struct task_security_struct *tsec = cred->security;
 349         int rc;
 350
 351         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 352                           FILESYSTEM__RELABELFROM, NULL);
 353         if (rc)
 354                 return rc;
 355
 356         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 357                           FILESYSTEM__RELABELTO, NULL);
 358         return rc;
 359 }
 360
 361 static int may_context_mount_inode_relabel(u32 sid,
 362                         struct superblock_security_struct *sbsec,
 363                         const struct cred *cred)
 364 {
 365         const struct task_security_struct *tsec = cred->security;
 366         int rc;
 367         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 368                           FILESYSTEM__RELABELFROM, NULL);
 369         if (rc)
 370                 return rc;
 371
 372         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 373                           FILESYSTEM__ASSOCIATE, NULL);
 374         return rc;
 375 }
 376
 377 static int selinux_is_sblabel_mnt(struct super_block *sb)
 378 {
 379         struct superblock_security_struct *sbsec = sb->s_security;
 380
 381         if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
 382             sbsec->behavior == SECURITY_FS_USE_TRANS ||
 383             sbsec->behavior == SECURITY_FS_USE_TASK)
 384                 return 1;
 385
 386         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 387         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 388                 return 1;
 389
 390         /*
 391          * Special handling for rootfs. Is genfs but supports
 392          * setting SELinux context on in-core inodes.
 393          */
 394         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 395                 return 1;
 396
 397         return 0;
 398 }
 399
 400 static int sb_finish_set_opts(struct super_block *sb)
 401 {
 402         struct superblock_security_struct *sbsec = sb->s_security;
 403         struct dentry *root = sb->s_root;
 404         struct inode *root_inode = root->d_inode;
 405         int rc = 0;
 406
 407         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 408                 /* Make sure that the xattr handler exists and that no
 409                    error other than -ENODATA is returned by getxattr on
 410                    the root directory.  -ENODATA is ok, as this may be
 411                    the first boot of the SELinux kernel before we have
 412                    assigned xattr values to the filesystem. */
 413                 if (!root_inode->i_op->getxattr) {
 414                         printk(KERN_WARNING "SELinux: (dev %s, type "SB_TYPE_FMT") has no "
 415                                "xattr support\n", sb->s_id, SB_TYPE_ARGS(sb));
 416                         rc = -EOPNOTSUPP;
 417                         goto out;
 418                 }
 419                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 420                 if (rc < 0 && rc != -ENODATA) {
 421                         if (rc == -EOPNOTSUPP)
 422                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 423                                        SB_TYPE_FMT") has no security xattr handler\n",
 424                                        sb->s_id, SB_TYPE_ARGS(sb));
 425                         else
 426                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 427                                        SB_TYPE_FMT") getxattr errno %d\n", sb->s_id,
 428                                        SB_TYPE_ARGS(sb), -rc);
 429                         goto out;
 430                 }
 431         }
 432
 433         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 434                 printk(KERN_ERR "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), unknown behavior\n",
 435                        sb->s_id, SB_TYPE_ARGS(sb));
 436         else
 437                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), %s\n",
 438                        sb->s_id, SB_TYPE_ARGS(sb),
 439                        labeling_behaviors[sbsec->behavior-1]);
 440
 441         sbsec->flags |= SE_SBINITIALIZED;
 442         if (selinux_is_sblabel_mnt(sb))
 443                 sbsec->flags |= SBLABEL_MNT;
 444
 445         /* Initialize the root inode. */
 446         rc = inode_doinit_with_dentry(root_inode, root);
 447
 448         /* Initialize any other inodes associated with the superblock, e.g.
 449            inodes created prior to initial policy load or inodes created
 450            during get_sb by a pseudo filesystem that directly
 451            populates itself. */
 452         spin_lock(&sbsec->isec_lock);
 453 next_inode:
 454         if (!list_empty(&sbsec->isec_head)) {
 455                 struct inode_security_struct *isec =
 456                                 list_entry(sbsec->isec_head.next,
 457                                            struct inode_security_struct, list);
 458                 struct inode *inode = isec->inode;
 459                 spin_unlock(&sbsec->isec_lock);
 460                 inode = igrab(inode);
 461                 if (inode) {
 462                         if (!IS_PRIVATE(inode))
 463                                 inode_doinit(inode);
 464                         iput(inode);
 465                 }
 466                 spin_lock(&sbsec->isec_lock);
 467                 list_del_init(&isec->list);
 468                 goto next_inode;
 469         }
 470         spin_unlock(&sbsec->isec_lock);
 471 out:
 472         return rc;
 473 }
 474
 475 /*
 476  * This function should allow an FS to ask what it's mount security
 477  * options were so it can use those later for submounts, displaying
 478  * mount options, or whatever.
 479  */
 480 static int selinux_get_mnt_opts(const struct super_block *sb,
 481                                 struct security_mnt_opts *opts)
 482 {
 483         int rc = 0, i;
 484         struct superblock_security_struct *sbsec = sb->s_security;
 485         char *context = NULL;
 486         u32 len;
 487         char tmp;
 488
 489         security_init_mnt_opts(opts);
 490
 491         if (!(sbsec->flags & SE_SBINITIALIZED))
 492                 return -EINVAL;
 493
 494         if (!ss_initialized)
 495                 return -EINVAL;
 496
 497         /* make sure we always check enough bits to cover the mask */
 498         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 499
 500         tmp = sbsec->flags & SE_MNTMASK;
 501         /* count the number of mount options for this sb */
 502         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 503                 if (tmp & 0x01)
 504                         opts->num_mnt_opts++;
 505                 tmp >>= 1;
 506         }
 507         /* Check if the Label support flag is set */
 508         if (sbsec->flags & SBLABEL_MNT)
 509                 opts->num_mnt_opts++;
 510
 511         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 512         if (!opts->mnt_opts) {
 513                 rc = -ENOMEM;
 514                 goto out_free;
 515         }
 516
 517         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 518         if (!opts->mnt_opts_flags) {
 519                 rc = -ENOMEM;
 520                 goto out_free;
 521         }
 522
 523         i = 0;
 524         if (sbsec->flags & FSCONTEXT_MNT) {
 525                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 526                 if (rc)
 527                         goto out_free;
 528                 opts->mnt_opts[i] = context;
 529                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 530         }
 531         if (sbsec->flags & CONTEXT_MNT) {
 532                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 533                 if (rc)
 534                         goto out_free;
 535                 opts->mnt_opts[i] = context;
 536                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 537         }
 538         if (sbsec->flags & DEFCONTEXT_MNT) {
 539                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 540                 if (rc)
 541                         goto out_free;
 542                 opts->mnt_opts[i] = context;
 543                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 544         }
 545         if (sbsec->flags & ROOTCONTEXT_MNT) {
 546                 struct inode *root = sbsec->sb->s_root->d_inode;
 547                 struct inode_security_struct *isec = root->i_security;
 548
 549                 rc = security_sid_to_context(isec->sid, &context, &len);
 550                 if (rc)
 551                         goto out_free;
 552                 opts->mnt_opts[i] = context;
 553                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 554         }
 555         if (sbsec->flags & SBLABEL_MNT) {
 556                 opts->mnt_opts[i] = NULL;
 557                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 558         }
 559
 560         BUG_ON(i != opts->num_mnt_opts);
 561
 562         return 0;
 563
 564 out_free:
 565         security_free_mnt_opts(opts);
 566         return rc;
 567 }
 568
 569 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 570                       u32 old_sid, u32 new_sid)
 571 {
 572         char mnt_flags = sbsec->flags & SE_MNTMASK;
 573
 574         /* check if the old mount command had the same options */
 575         if (sbsec->flags & SE_SBINITIALIZED)
 576                 if (!(sbsec->flags & flag) ||
 577                     (old_sid != new_sid))
 578                         return 1;
 579
 580         /* check if we were passed the same options twice,
 581          * aka someone passed context=a,context=b
 582          */
 583         if (!(sbsec->flags & SE_SBINITIALIZED))
 584                 if (mnt_flags & flag)
 585                         return 1;
 586         return 0;
 587 }
 588
 589 /*
 590  * Allow filesystems with binary mount data to explicitly set mount point
 591  * labeling information.
 592  */
 593 static int selinux_set_mnt_opts(struct super_block *sb,
 594                                 struct security_mnt_opts *opts)
 595 {
 596         const struct cred *cred = current_cred();
 597         int rc = 0, i;
 598         struct superblock_security_struct *sbsec = sb->s_security;
 599         struct inode *inode = sbsec->sb->s_root->d_inode;
 600         struct inode_security_struct *root_isec = inode->i_security;
 601         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 602         u32 defcontext_sid = 0;
 603         char **mount_options = opts->mnt_opts;
 604         int *flags = opts->mnt_opts_flags;
 605         int num_opts = opts->num_mnt_opts;
 606
 607         mutex_lock(&sbsec->lock);
 608
 609         if (!ss_initialized) {
 610                 if (!num_opts) {
 611                         /* Defer initialization until selinux_complete_init,
 612                            after the initial policy is loaded and the security
 613                            server is ready to handle calls. */
 614                         goto out;
 615                 }
 616                 rc = -EINVAL;
 617                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 618                         "before the security server is initialized\n");
 619                 goto out;
 620         }
 621
 622         /*
 623          * Binary mount data FS will come through this function twice.  Once
 624          * from an explicit call and once from the generic calls from the vfs.
 625          * Since the generic VFS calls will not contain any security mount data
 626          * we need to skip the double mount verification.
 627          *
 628          * This does open a hole in which we will not notice if the first
 629          * mount using this sb set explict options and a second mount using
 630          * this sb does not set any security options.  (The first options
 631          * will be used for both mounts)
 632          */
 633         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 634             && (num_opts == 0))
 635                 goto out;
 636
 637         /*
 638          * parse the mount options, check if they are valid sids.
 639          * also check if someone is trying to mount the same sb more
 640          * than once with different security options.
 641          */
 642         for (i = 0; i < num_opts; i++) {
 643                 u32 sid;
 644
 645                 if (flags[i] == SBLABEL_MNT)
 646                         continue;
 647                 rc = security_context_to_sid(mount_options[i],
 648                                              strlen(mount_options[i]), &sid);
 649                 if (rc) {
 650                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 651                                "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
 652                                mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
 653                         goto out;
 654                 }
 655                 switch (flags[i]) {
 656                 case FSCONTEXT_MNT:
 657                         fscontext_sid = sid;
 658
 659                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 660                                         fscontext_sid))
 661                                 goto out_double_mount;
 662
 663                         sbsec->flags |= FSCONTEXT_MNT;
 664                         break;
 665                 case CONTEXT_MNT:
 666                         context_sid = sid;
 667
 668                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 669                                         context_sid))
 670                                 goto out_double_mount;
 671
 672                         sbsec->flags |= CONTEXT_MNT;
 673                         break;
 674                 case ROOTCONTEXT_MNT:
 675                         rootcontext_sid = sid;
 676
 677                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 678                                         rootcontext_sid))
 679                                 goto out_double_mount;
 680
 681                         sbsec->flags |= ROOTCONTEXT_MNT;
 682
 683                         break;
 684                 case DEFCONTEXT_MNT:
 685                         defcontext_sid = sid;
 686
 687                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 688                                         defcontext_sid))
 689                                 goto out_double_mount;
 690
 691                         sbsec->flags |= DEFCONTEXT_MNT;
 692
 693                         break;
 694                 default:
 695                         rc = -EINVAL;
 696                         goto out;
 697                 }
 698         }
 699
 700         if (sbsec->flags & SE_SBINITIALIZED) {
 701                 /* previously mounted with options, but not on this attempt? */
 702                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 703                         goto out_double_mount;
 704                 rc = 0;
 705                 goto out;
 706         }
 707
 708         if (strcmp(sb->s_type->name, "proc") == 0)
 709                 sbsec->flags |= SE_SBPROC;
 710
 711         /* Determine the labeling behavior to use for this filesystem type. */
 712         rc = security_fs_use(sb);
 713         if (rc) {
 714                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 715                        __func__, sb->s_type->name, rc);
 716                 goto out;
 717         }
 718
 719         /* sets the context of the superblock for the fs being mounted. */
 720         if (fscontext_sid) {
 721                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 722                 if (rc)
 723                         goto out;
 724
 725                 sbsec->sid = fscontext_sid;
 726         }
 727
 728         /*
 729          * Switch to using mount point labeling behavior.
 730          * sets the label used on all file below the mountpoint, and will set
 731          * the superblock context if not already set.
 732          */
 733         if (context_sid) {
 734                 if (!fscontext_sid) {
 735                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 736                                                           cred);
 737                         if (rc)
 738                                 goto out;
 739                         sbsec->sid = context_sid;
 740                 } else {
 741                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 742                                                              cred);
 743                         if (rc)
 744                                 goto out;
 745                 }
 746                 if (!rootcontext_sid)
 747                         rootcontext_sid = context_sid;
 748
 749                 sbsec->mntpoint_sid = context_sid;
 750                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 751         }
 752
 753         if (rootcontext_sid) {
 754                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 755                                                      cred);
 756                 if (rc)
 757                         goto out;
 758
 759                 root_isec->sid = rootcontext_sid;
 760                 root_isec->initialized = 1;
 761         }
 762
 763         if (defcontext_sid) {
 764                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 765                         rc = -EINVAL;
 766                         printk(KERN_WARNING "SELinux: defcontext option is "
 767                                "invalid for this filesystem type\n");
 768                         goto out;
 769                 }
 770
 771                 if (defcontext_sid != sbsec->def_sid) {
 772                         rc = may_context_mount_inode_relabel(defcontext_sid,
 773                                                              sbsec, cred);
 774                         if (rc)
 775                                 goto out;
 776                 }
 777
 778                 sbsec->def_sid = defcontext_sid;
 779         }
 780
 781         rc = sb_finish_set_opts(sb);
 782 out:
 783         mutex_unlock(&sbsec->lock);
 784         return rc;
 785 out_double_mount:
 786         rc = -EINVAL;
 787         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 788                "security settings for (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
 789                SB_TYPE_ARGS(sb));
 790         goto out;
 791 }
 792
 793 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 794                                     const struct super_block *newsb)
 795 {
 796         struct superblock_security_struct *old = oldsb->s_security;
 797         struct superblock_security_struct *new = newsb->s_security;
 798         char oldflags = old->flags & SE_MNTMASK;
 799         char newflags = new->flags & SE_MNTMASK;
 800
 801         if (oldflags != newflags)
 802                 goto mismatch;
 803         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 804                 goto mismatch;
 805         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 806                 goto mismatch;
 807         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 808                 goto mismatch;
 809         if (oldflags & ROOTCONTEXT_MNT) {
 810                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 811                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 812                 if (oldroot->sid != newroot->sid)
 813                         goto mismatch;
 814         }
 815         return 0;
 816 mismatch:
 817         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 818                             "different security settings for (dev %s, "
 819                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 820         return -EBUSY;
 821 }
 822
 823 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 824                                         struct super_block *newsb)
 825 {
 826         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 827         struct superblock_security_struct *newsbsec = newsb->s_security;
 828
 829         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 830         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 831         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 832
 833         /*
 834          * if the parent was able to be mounted it clearly had no special lsm
 835          * mount options.  thus we can safely deal with this superblock later
 836          */
 837         if (!ss_initialized)
 838                 return 0;
 839
 840         /* how can we clone if the old one wasn't set up?? */
 841         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 842
 843         /* if fs is reusing a sb, make sure that the contexts match */
 844         if (newsbsec->flags & SE_SBINITIALIZED)
 845                 return selinux_cmp_sb_context(oldsb, newsb);
 846
 847         mutex_lock(&newsbsec->lock);
 848
 849         newsbsec->flags = oldsbsec->flags;
 850
 851         newsbsec->sid = oldsbsec->sid;
 852         newsbsec->def_sid = oldsbsec->def_sid;
 853         newsbsec->behavior = oldsbsec->behavior;
 854
 855         if (set_context) {
 856                 u32 sid = oldsbsec->mntpoint_sid;
 857
 858                 if (!set_fscontext)
 859                         newsbsec->sid = sid;
 860                 if (!set_rootcontext) {
 861                         struct inode *newinode = newsb->s_root->d_inode;
 862                         struct inode_security_struct *newisec = newinode->i_security;
 863                         newisec->sid = sid;
 864                 }
 865                 newsbsec->mntpoint_sid = sid;
 866         }
 867         if (set_rootcontext) {
 868                 const struct inode *oldinode = oldsb->s_root->d_inode;
 869                 const struct inode_security_struct *oldisec = oldinode->i_security;
 870                 struct inode *newinode = newsb->s_root->d_inode;
 871                 struct inode_security_struct *newisec = newinode->i_security;
 872
 873                 newisec->sid = oldisec->sid;
 874         }
 875
 876         sb_finish_set_opts(newsb);
 877         mutex_unlock(&newsbsec->lock);
 878         return 0;
 879 }
 880
 881 static int selinux_parse_opts_str(char *options,
 882                                   struct security_mnt_opts *opts)
 883 {
 884         char *p;
 885         char *context = NULL, *defcontext = NULL;
 886         char *fscontext = NULL, *rootcontext = NULL;
 887         int rc, num_mnt_opts = 0;
 888
 889         opts->num_mnt_opts = 0;
 890
 891         /* Standard string-based options. */
 892         while ((p = strsep(&options, "|")) != NULL) {
 893                 int token;
 894                 substring_t args[MAX_OPT_ARGS];
 895
 896                 if (!*p)
 897                         continue;
 898
 899                 token = match_token(p, tokens, args);
 900
 901                 switch (token) {
 902                 case Opt_context:
 903                         if (context || defcontext) {
 904                                 rc = -EINVAL;
 905                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 906                                 goto out_err;
 907                         }
 908                         context = match_strdup(&args[0]);
 909                         if (!context) {
 910                                 rc = -ENOMEM;
 911                                 goto out_err;
 912                         }
 913                         break;
 914
 915                 case Opt_fscontext:
 916                         if (fscontext) {
 917                                 rc = -EINVAL;
 918                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 919                                 goto out_err;
 920                         }
 921                         fscontext = match_strdup(&args[0]);
 922                         if (!fscontext) {
 923                                 rc = -ENOMEM;
 924                                 goto out_err;
 925                         }
 926                         break;
 927
 928                 case Opt_rootcontext:
 929                         if (rootcontext) {
 930                                 rc = -EINVAL;
 931                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 932                                 goto out_err;
 933                         }
 934                         rootcontext = match_strdup(&args[0]);
 935                         if (!rootcontext) {
 936                                 rc = -ENOMEM;
 937                                 goto out_err;
 938                         }
 939                         break;
 940
 941                 case Opt_defcontext:
 942                         if (context || defcontext) {
 943                                 rc = -EINVAL;
 944                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 945                                 goto out_err;
 946                         }
 947                         defcontext = match_strdup(&args[0]);
 948                         if (!defcontext) {
 949                                 rc = -ENOMEM;
 950                                 goto out_err;
 951                         }
 952                         break;
 953                 case Opt_labelsupport:
 954                         break;
 955                 default:
 956                         rc = -EINVAL;
 957                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 958                         goto out_err;
 959
 960                 }
 961         }
 962
 963         rc = -ENOMEM;
 964         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 965         if (!opts->mnt_opts)
 966                 goto out_err;
 967
 968         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 969         if (!opts->mnt_opts_flags) {
 970                 kfree(opts->mnt_opts);
 971                 goto out_err;
 972         }
 973
 974         if (fscontext) {
 975                 opts->mnt_opts[num_mnt_opts] = fscontext;
 976                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 977         }
 978         if (context) {
 979                 opts->mnt_opts[num_mnt_opts] = context;
 980                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 981         }
 982         if (rootcontext) {
 983                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 984                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 985         }
 986         if (defcontext) {
 987                 opts->mnt_opts[num_mnt_opts] = defcontext;
 988                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 989         }
 990
 991         opts->num_mnt_opts = num_mnt_opts;
 992         return 0;
 993
 994 out_err:
 995         kfree(context);
 996         kfree(defcontext);
 997         kfree(fscontext);
 998         kfree(rootcontext);
 999         return rc;
1000 }
1001 /*
1002  * string mount options parsing and call set the sbsec
1003  */
1004 static int superblock_doinit(struct super_block *sb, void *data)
1005 {
1006         int rc = 0;
1007         char *options = data;
1008         struct security_mnt_opts opts;
1009
1010         security_init_mnt_opts(&opts);
1011
1012         if (!data)
1013                 goto out;
1014
1015         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1016
1017         rc = selinux_parse_opts_str(options, &opts);
1018         if (rc)
1019                 goto out_err;
1020
1021 out:
1022         rc = selinux_set_mnt_opts(sb, &opts);
1023
1024 out_err:
1025         security_free_mnt_opts(&opts);
1026         return rc;
1027 }
1028
1029 static void selinux_write_opts(struct seq_file *m,
1030                                struct security_mnt_opts *opts)
1031 {
1032         int i;
1033         char *prefix;
1034
1035         for (i = 0; i < opts->num_mnt_opts; i++) {
1036                 char *has_comma;
1037
1038                 if (opts->mnt_opts[i])
1039                         has_comma = strchr(opts->mnt_opts[i], ',');
1040                 else
1041                         has_comma = NULL;
1042
1043                 switch (opts->mnt_opts_flags[i]) {
1044                 case CONTEXT_MNT:
1045                         prefix = CONTEXT_STR;
1046                         break;
1047                 case FSCONTEXT_MNT:
1048                         prefix = FSCONTEXT_STR;
1049                         break;
1050                 case ROOTCONTEXT_MNT:
1051                         prefix = ROOTCONTEXT_STR;
1052                         break;
1053                 case DEFCONTEXT_MNT:
1054                         prefix = DEFCONTEXT_STR;
1055                         break;
1056                 case SBLABEL_MNT:
1057                         seq_putc(m, ',');
1058                         seq_puts(m, LABELSUPP_STR);
1059                         continue;
1060                 default:
1061                         BUG();
1062                         return;
1063                 };
1064                 /* we need a comma before each option */
1065                 seq_putc(m, ',');
1066                 seq_puts(m, prefix);
1067                 if (has_comma)
1068                         seq_putc(m, '\"');
1069                 seq_puts(m, opts->mnt_opts[i]);
1070                 if (has_comma)
1071                         seq_putc(m, '\"');
1072         }
1073 }
1074
1075 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1076 {
1077         struct security_mnt_opts opts;
1078         int rc;
1079
1080         rc = selinux_get_mnt_opts(sb, &opts);
1081         if (rc) {
1082                 /* before policy load we may get EINVAL, don't show anything */
1083                 if (rc == -EINVAL)
1084                         rc = 0;
1085                 return rc;
1086         }
1087
1088         selinux_write_opts(m, &opts);
1089
1090         security_free_mnt_opts(&opts);
1091
1092         return rc;
1093 }
1094
1095 static inline u16 inode_mode_to_security_class(umode_t mode)
1096 {
1097         switch (mode & S_IFMT) {
1098         case S_IFSOCK:
1099                 return SECCLASS_SOCK_FILE;
1100         case S_IFLNK:
1101                 return SECCLASS_LNK_FILE;
1102         case S_IFREG:
1103                 return SECCLASS_FILE;
1104         case S_IFBLK:
1105                 return SECCLASS_BLK_FILE;
1106         case S_IFDIR:
1107                 return SECCLASS_DIR;
1108         case S_IFCHR:
1109                 return SECCLASS_CHR_FILE;
1110         case S_IFIFO:
1111                 return SECCLASS_FIFO_FILE;
1112
1113         }
1114
1115         return SECCLASS_FILE;
1116 }
1117
1118 static inline int default_protocol_stream(int protocol)
1119 {
1120         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1121 }
1122
1123 static inline int default_protocol_dgram(int protocol)
1124 {
1125         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1126 }
1127
1128 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1129 {
1130         switch (family) {
1131         case PF_UNIX:
1132                 switch (type) {
1133                 case SOCK_STREAM:
1134                 case SOCK_SEQPACKET:
1135                         return SECCLASS_UNIX_STREAM_SOCKET;
1136                 case SOCK_DGRAM:
1137                         return SECCLASS_UNIX_DGRAM_SOCKET;
1138                 }
1139                 break;
1140         case PF_INET:
1141         case PF_INET6:
1142                 switch (type) {
1143                 case SOCK_STREAM:
1144                         if (default_protocol_stream(protocol))
1145                                 return SECCLASS_TCP_SOCKET;
1146                         else
1147                                 return SECCLASS_RAWIP_SOCKET;
1148                 case SOCK_DGRAM:
1149                         if (default_protocol_dgram(protocol))
1150                                 return SECCLASS_UDP_SOCKET;
1151                         else
1152                                 return SECCLASS_RAWIP_SOCKET;
1153                 case SOCK_DCCP:
1154                         return SECCLASS_DCCP_SOCKET;
1155                 default:
1156                         return SECCLASS_RAWIP_SOCKET;
1157                 }
1158                 break;
1159         case PF_NETLINK:
1160                 switch (protocol) {
1161                 case NETLINK_ROUTE:
1162                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1163                 case NETLINK_FIREWALL:
1164                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1165                 case NETLINK_SOCK_DIAG:
1166                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1167                 case NETLINK_NFLOG:
1168                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1169                 case NETLINK_XFRM:
1170                         return SECCLASS_NETLINK_XFRM_SOCKET;
1171                 case NETLINK_SELINUX:
1172                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1173                 case NETLINK_AUDIT:
1174                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1175                 case NETLINK_IP6_FW:
1176                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1177                 case NETLINK_DNRTMSG:
1178                         return SECCLASS_NETLINK_DNRT_SOCKET;
1179                 case NETLINK_KOBJECT_UEVENT:
1180                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1181                 default:
1182                         return SECCLASS_NETLINK_SOCKET;
1183                 }
1184         case PF_PACKET:
1185                 return SECCLASS_PACKET_SOCKET;
1186         case PF_KEY:
1187                 return SECCLASS_KEY_SOCKET;
1188         case PF_APPLETALK:
1189                 return SECCLASS_APPLETALK_SOCKET;
1190         }
1191
1192         return SECCLASS_SOCKET;
1193 }
1194
1195 #ifdef CONFIG_PROC_FS
1196 static int selinux_proc_get_sid(struct dentry *dentry,
1197                                 u16 tclass,
1198                                 u32 *sid)
1199 {
1200         int rc;
1201         char *buffer, *path;
1202
1203         buffer = (char *)__get_free_page(GFP_KERNEL);
1204         if (!buffer)
1205                 return -ENOMEM;
1206
1207         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1208         if (IS_ERR(path))
1209                 rc = PTR_ERR(path);
1210         else {
1211                 /* each process gets a /proc/PID/ entry. Strip off the
1212                  * PID part to get a valid selinux labeling.
1213                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1214                 while (path[1] >= '0' && path[1] <= '9') {
1215                         path[1] = '/';
1216                         path++;
1217                 }
1218                 rc = security_genfs_sid("proc", path, tclass, sid);
1219         }
1220         free_page((unsigned long)buffer);
1221         return rc;
1222 }
1223 #else
1224 static int selinux_proc_get_sid(struct dentry *dentry,
1225                                 u16 tclass,
1226                                 u32 *sid)
1227 {
1228         return -EINVAL;
1229 }
1230 #endif
1231
1232 /* The inode's security attributes must be initialized before first use. */
1233 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1234 {
1235         struct superblock_security_struct *sbsec = NULL;
1236         struct inode_security_struct *isec = inode->i_security;
1237         u32 sid;
1238         struct dentry *dentry;
1239 #define INITCONTEXTLEN 255
1240         char *context = NULL;
1241         unsigned len = 0;
1242         int rc = 0;
1243
1244         if (isec->initialized)
1245                 goto out;
1246
1247         mutex_lock(&isec->lock);
1248         if (isec->initialized)
1249                 goto out_unlock;
1250
1251         sbsec = inode->i_sb->s_security;
1252         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1253                 /* Defer initialization until selinux_complete_init,
1254                    after the initial policy is loaded and the security
1255                    server is ready to handle calls. */
1256                 spin_lock(&sbsec->isec_lock);
1257                 if (list_empty(&isec->list))
1258                         list_add(&isec->list, &sbsec->isec_head);
1259                 spin_unlock(&sbsec->isec_lock);
1260                 goto out_unlock;
1261         }
1262
1263         switch (sbsec->behavior) {
1264         case SECURITY_FS_USE_XATTR:
1265                 if (!inode->i_op->getxattr) {
1266                         isec->sid = sbsec->def_sid;
1267                         break;
1268                 }
1269
1270                 /* Need a dentry, since the xattr API requires one.
1271                    Life would be simpler if we could just pass the inode. */
1272                 if (opt_dentry) {
1273                         /* Called from d_instantiate or d_splice_alias. */
1274                         dentry = dget(opt_dentry);
1275                 } else {
1276                         /* Called from selinux_complete_init, try to find a dentry. */
1277                         dentry = d_find_alias(inode);
1278                 }
1279                 if (!dentry) {
1280                         /*
1281                          * this is can be hit on boot when a file is accessed
1282                          * before the policy is loaded.  When we load policy we
1283                          * may find inodes that have no dentry on the
1284                          * sbsec->isec_head list.  No reason to complain as these
1285                          * will get fixed up the next time we go through
1286                          * inode_doinit with a dentry, before these inodes could
1287                          * be used again by userspace.
1288                          */
1289                         goto out_unlock;
1290                 }
1291
1292                 len = INITCONTEXTLEN;
1293                 context = kmalloc(len+1, GFP_NOFS);
1294                 if (!context) {
1295                         rc = -ENOMEM;
1296                         dput(dentry);
1297                         goto out_unlock;
1298                 }
1299                 context[len] = '\0';
1300                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1301                                            context, len);
1302                 if (rc == -ERANGE) {
1303                         kfree(context);
1304
1305                         /* Need a larger buffer.  Query for the right size. */
1306                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1307                                                    NULL, 0);
1308                         if (rc < 0) {
1309                                 dput(dentry);
1310                                 goto out_unlock;
1311                         }
1312                         len = rc;
1313                         context = kmalloc(len+1, GFP_NOFS);
1314                         if (!context) {
1315                                 rc = -ENOMEM;
1316                                 dput(dentry);
1317                                 goto out_unlock;
1318                         }
1319                         context[len] = '\0';
1320                         rc = inode->i_op->getxattr(dentry,
1321                                                    XATTR_NAME_SELINUX,
1322                                                    context, len);
1323                 }
1324                 dput(dentry);
1325                 if (rc < 0) {
1326                         if (rc != -ENODATA) {
1327                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1328                                        "%d for dev=%s ino=%ld\n", __func__,
1329                                        -rc, inode->i_sb->s_id, inode->i_ino);
1330                                 kfree(context);
1331                                 goto out_unlock;
1332                         }
1333                         /* Map ENODATA to the default file SID */
1334                         sid = sbsec->def_sid;
1335                         rc = 0;
1336                 } else {
1337                         rc = security_context_to_sid_default(context, rc, &sid,
1338                                                              sbsec->def_sid,
1339                                                              GFP_NOFS);
1340                         if (rc) {
1341                                 char *dev = inode->i_sb->s_id;
1342                                 unsigned long ino = inode->i_ino;
1343
1344                                 if (rc == -EINVAL) {
1345                                         if (printk_ratelimit())
1346                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1347                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1348                                                         "filesystem in question.\n", ino, dev, context);
1349                                 } else {
1350                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1351                                                "returned %d for dev=%s ino=%ld\n",
1352                                                __func__, context, -rc, dev, ino);
1353                                 }
1354                                 kfree(context);
1355                                 /* Leave with the unlabeled SID */
1356                                 rc = 0;
1357                                 break;
1358                         }
1359                 }
1360                 kfree(context);
1361                 isec->sid = sid;
1362                 break;
1363         case SECURITY_FS_USE_TASK:
1364                 isec->sid = isec->task_sid;
1365                 break;
1366         case SECURITY_FS_USE_TRANS:
1367                 /* Default to the fs SID. */
1368                 isec->sid = sbsec->sid;
1369
1370                 /* Try to obtain a transition SID. */
1371                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1372                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1373                                              isec->sclass, NULL, &sid);
1374                 if (rc)
1375                         goto out_unlock;
1376                 isec->sid = sid;
1377                 break;
1378         case SECURITY_FS_USE_MNTPOINT:
1379                 isec->sid = sbsec->mntpoint_sid;
1380                 break;
1381         default:
1382                 /* Default to the fs superblock SID. */
1383                 isec->sid = sbsec->sid;
1384
1385                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1386                         if (opt_dentry) {
1387                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1388                                 rc = selinux_proc_get_sid(opt_dentry,
1389                                                           isec->sclass,
1390                                                           &sid);
1391                                 if (rc)
1392                                         goto out_unlock;
1393                                 isec->sid = sid;
1394                         }
1395                 }
1396                 break;
1397         }
1398
1399         isec->initialized = 1;
1400
1401 out_unlock:
1402         mutex_unlock(&isec->lock);
1403 out:
1404         if (isec->sclass == SECCLASS_FILE)
1405                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1406         return rc;
1407 }
1408
1409 /* Convert a Linux signal to an access vector. */
1410 static inline u32 signal_to_av(int sig)
1411 {
1412         u32 perm = 0;
1413
1414         switch (sig) {
1415         case SIGCHLD:
1416                 /* Commonly granted from child to parent. */
1417                 perm = PROCESS__SIGCHLD;
1418                 break;
1419         case SIGKILL:
1420                 /* Cannot be caught or ignored */
1421                 perm = PROCESS__SIGKILL;
1422                 break;
1423         case SIGSTOP:
1424                 /* Cannot be caught or ignored */
1425                 perm = PROCESS__SIGSTOP;
1426                 break;
1427         default:
1428                 /* All other signals. */
1429                 perm = PROCESS__SIGNAL;
1430                 break;
1431         }
1432
1433         return perm;
1434 }
1435
1436 /*
1437  * Check permission between a pair of credentials
1438  * fork check, ptrace check, etc.
1439  */
1440 static int cred_has_perm(const struct cred *actor,
1441                          const struct cred *target,
1442                          u32 perms)
1443 {
1444         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1445
1446         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1447 }
1448
1449 /*
1450  * Check permission between a pair of tasks, e.g. signal checks,
1451  * fork check, ptrace check, etc.
1452  * tsk1 is the actor and tsk2 is the target
1453  * - this uses the default subjective creds of tsk1
1454  */
1455 static int task_has_perm(const struct task_struct *tsk1,
1456                          const struct task_struct *tsk2,
1457                          u32 perms)
1458 {
1459         const struct task_security_struct *__tsec1, *__tsec2;
1460         u32 sid1, sid2;
1461
1462         rcu_read_lock();
1463         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1464         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1465         rcu_read_unlock();
1466         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1467 }
1468
1469 /*
1470  * Check permission between current and another task, e.g. signal checks,
1471  * fork check, ptrace check, etc.
1472  * current is the actor and tsk2 is the target
1473  * - this uses current's subjective creds
1474  */
1475 static int current_has_perm(const struct task_struct *tsk,
1476                             u32 perms)
1477 {
1478         u32 sid, tsid;
1479
1480         sid = current_sid();
1481         tsid = task_sid(tsk);
1482         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1483 }
1484
1485 #if CAP_LAST_CAP > 63
1486 #error Fix SELinux to handle capabilities > 63.
1487 #endif
1488
1489 /* Check whether a task is allowed to use a capability. */
1490 static int cred_has_capability(const struct cred *cred,
1491                                int cap, int audit)
1492 {
1493         struct common_audit_data ad;
1494         struct av_decision avd;
1495         u16 sclass;
1496         u32 sid = cred_sid(cred);
1497         u32 av = CAP_TO_MASK(cap);
1498         int rc;
1499
1500         ad.type = LSM_AUDIT_DATA_CAP;
1501         ad.u.cap = cap;
1502
1503         switch (CAP_TO_INDEX(cap)) {
1504         case 0:
1505                 sclass = SECCLASS_CAPABILITY;
1506                 break;
1507         case 1:
1508                 sclass = SECCLASS_CAPABILITY2;
1509                 break;
1510         default:
1511                 printk(KERN_ERR
1512                        "SELinux:  out of range capability %d\n", cap);
1513                 BUG();
1514                 return -EINVAL;
1515         }
1516
1517         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1518         if (audit == SECURITY_CAP_AUDIT) {
1519                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1520                 if (rc2)
1521                         return rc2;
1522         }
1523         return rc;
1524 }
1525
1526 /* Check whether a task is allowed to use a system operation. */
1527 static int task_has_system(struct task_struct *tsk,
1528                            u32 perms)
1529 {
1530         u32 sid = task_sid(tsk);
1531
1532         return avc_has_perm(sid, SECINITSID_KERNEL,
1533                             SECCLASS_SYSTEM, perms, NULL);
1534 }
1535
1536 /* Check whether a task has a particular permission to an inode.
1537    The 'adp' parameter is optional and allows other audit
1538    data to be passed (e.g. the dentry). */
1539 static int inode_has_perm(const struct cred *cred,
1540                           struct inode *inode,
1541                           u32 perms,
1542                           struct common_audit_data *adp,
1543                           unsigned flags)
1544 {
1545         struct inode_security_struct *isec;
1546         u32 sid;
1547
1548         validate_creds(cred);
1549
1550         if (unlikely(IS_PRIVATE(inode)))
1551                 return 0;
1552
1553         sid = cred_sid(cred);
1554         isec = inode->i_security;
1555
1556         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1557 }
1558
1559 /* Same as inode_has_perm, but pass explicit audit data containing
1560    the dentry to help the auditing code to more easily generate the
1561    pathname if needed. */
1562 static inline int dentry_has_perm(const struct cred *cred,
1563                                   struct dentry *dentry,
1564                                   u32 av)
1565 {
1566         struct inode *inode = dentry->d_inode;
1567         struct common_audit_data ad;
1568
1569         ad.type = LSM_AUDIT_DATA_DENTRY;
1570         ad.u.dentry = dentry;
1571         return inode_has_perm(cred, inode, av, &ad, 0);
1572 }
1573
1574 /* Same as inode_has_perm, but pass explicit audit data containing
1575    the path to help the auditing code to more easily generate the
1576    pathname if needed. */
1577 static inline int path_has_perm(const struct cred *cred,
1578                                 struct path *path,
1579                                 u32 av)
1580 {
1581         struct inode *inode = path->dentry->d_inode;
1582         struct common_audit_data ad;
1583
1584         ad.type = LSM_AUDIT_DATA_PATH;
1585         ad.u.path = *path;
1586         return inode_has_perm(cred, inode, av, &ad, 0);
1587 }
1588
1589 /* Check whether a task can use an open file descriptor to
1590    access an inode in a given way.  Check access to the
1591    descriptor itself, and then use dentry_has_perm to
1592    check a particular permission to the file.
1593    Access to the descriptor is implicitly granted if it
1594    has the same SID as the process.  If av is zero, then
1595    access to the file is not checked, e.g. for cases
1596    where only the descriptor is affected like seek. */
1597 static int file_has_perm(const struct cred *cred,
1598                          struct file *file,
1599                          u32 av)
1600 {
1601         struct file_security_struct *fsec = file->f_security;
1602         struct inode *inode = file_inode(file);
1603         struct common_audit_data ad;
1604         u32 sid = cred_sid(cred);
1605         int rc;
1606
1607         ad.type = LSM_AUDIT_DATA_PATH;
1608         ad.u.path = file->f_path;
1609
1610         if (sid != fsec->sid) {
1611                 rc = avc_has_perm(sid, fsec->sid,
1612                                   SECCLASS_FD,
1613                                   FD__USE,
1614                                   &ad);
1615                 if (rc)
1616                         goto out;
1617         }
1618
1619         /* av is zero if only checking access to the descriptor. */
1620         rc = 0;
1621         if (av)
1622                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1623
1624 out:
1625         return rc;
1626 }
1627
1628 /* Check whether a task can create a file. */
1629 static int may_create(struct inode *dir,
1630                       struct dentry *dentry,
1631                       u16 tclass)
1632 {
1633         const struct task_security_struct *tsec = current_security();
1634         struct inode_security_struct *dsec;
1635         struct superblock_security_struct *sbsec;
1636         u32 sid, newsid;
1637         struct common_audit_data ad;
1638         int rc;
1639
1640         dsec = dir->i_security;
1641         sbsec = dir->i_sb->s_security;
1642
1643         sid = tsec->sid;
1644         newsid = tsec->create_sid;
1645
1646         ad.type = LSM_AUDIT_DATA_DENTRY;
1647         ad.u.dentry = dentry;
1648
1649         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1650                           DIR__ADD_NAME | DIR__SEARCH,
1651                           &ad);
1652         if (rc)
1653                 return rc;
1654
1655         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1656                 rc = security_transition_sid(sid, dsec->sid, tclass,
1657                                              &dentry->d_name, &newsid);
1658                 if (rc)
1659                         return rc;
1660         }
1661
1662         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1663         if (rc)
1664                 return rc;
1665
1666         return avc_has_perm(newsid, sbsec->sid,
1667                             SECCLASS_FILESYSTEM,
1668                             FILESYSTEM__ASSOCIATE, &ad);
1669 }
1670
1671 /* Check whether a task can create a key. */
1672 static int may_create_key(u32 ksid,
1673                           struct task_struct *ctx)
1674 {
1675         u32 sid = task_sid(ctx);
1676
1677         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1678 }
1679
1680 #define MAY_LINK        0
1681 #define MAY_UNLINK      1
1682 #define MAY_RMDIR       2
1683
1684 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1685 static int may_link(struct inode *dir,
1686                     struct dentry *dentry,
1687                     int kind)
1688
1689 {
1690         struct inode_security_struct *dsec, *isec;
1691         struct common_audit_data ad;
1692         u32 sid = current_sid();
1693         u32 av;
1694         int rc;
1695
1696         dsec = dir->i_security;
1697         isec = dentry->d_inode->i_security;
1698
1699         ad.type = LSM_AUDIT_DATA_DENTRY;
1700         ad.u.dentry = dentry;
1701
1702         av = DIR__SEARCH;
1703         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1704         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1705         if (rc)
1706                 return rc;
1707
1708         switch (kind) {
1709         case MAY_LINK:
1710                 av = FILE__LINK;
1711                 break;
1712         case MAY_UNLINK:
1713                 av = FILE__UNLINK;
1714                 break;
1715         case MAY_RMDIR:
1716                 av = DIR__RMDIR;
1717                 break;
1718         default:
1719                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1720                         __func__, kind);
1721                 return 0;
1722         }
1723
1724         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1725         return rc;
1726 }
1727
1728 static inline int may_rename(struct inode *old_dir,
1729                              struct dentry *old_dentry,
1730                              struct inode *new_dir,
1731                              struct dentry *new_dentry)
1732 {
1733         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1734         struct common_audit_data ad;
1735         u32 sid = current_sid();
1736         u32 av;
1737         int old_is_dir, new_is_dir;
1738         int rc;
1739
1740         old_dsec = old_dir->i_security;
1741         old_isec = old_dentry->d_inode->i_security;
1742         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1743         new_dsec = new_dir->i_security;
1744
1745         ad.type = LSM_AUDIT_DATA_DENTRY;
1746
1747         ad.u.dentry = old_dentry;
1748         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1749                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1750         if (rc)
1751                 return rc;
1752         rc = avc_has_perm(sid, old_isec->sid,
1753                           old_isec->sclass, FILE__RENAME, &ad);
1754         if (rc)
1755                 return rc;
1756         if (old_is_dir && new_dir != old_dir) {
1757                 rc = avc_has_perm(sid, old_isec->sid,
1758                                   old_isec->sclass, DIR__REPARENT, &ad);
1759                 if (rc)
1760                         return rc;
1761         }
1762
1763         ad.u.dentry = new_dentry;
1764         av = DIR__ADD_NAME | DIR__SEARCH;
1765         if (new_dentry->d_inode)
1766                 av |= DIR__REMOVE_NAME;
1767         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1768         if (rc)
1769                 return rc;
1770         if (new_dentry->d_inode) {
1771                 new_isec = new_dentry->d_inode->i_security;
1772                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1773                 rc = avc_has_perm(sid, new_isec->sid,
1774                                   new_isec->sclass,
1775                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1776                 if (rc)
1777                         return rc;
1778         }
1779
1780         return 0;
1781 }
1782
1783 /* Check whether a task can perform a filesystem operation. */
1784 static int superblock_has_perm(const struct cred *cred,
1785                                struct super_block *sb,
1786                                u32 perms,
1787                                struct common_audit_data *ad)
1788 {
1789         struct superblock_security_struct *sbsec;
1790         u32 sid = cred_sid(cred);
1791
1792         sbsec = sb->s_security;
1793         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1794 }
1795
1796 /* Convert a Linux mode and permission mask to an access vector. */
1797 static inline u32 file_mask_to_av(int mode, int mask)
1798 {
1799         u32 av = 0;
1800
1801         if (!S_ISDIR(mode)) {
1802                 if (mask & MAY_EXEC)
1803                         av |= FILE__EXECUTE;
1804                 if (mask & MAY_READ)
1805                         av |= FILE__READ;
1806
1807                 if (mask & MAY_APPEND)
1808                         av |= FILE__APPEND;
1809                 else if (mask & MAY_WRITE)
1810                         av |= FILE__WRITE;
1811
1812         } else {
1813                 if (mask & MAY_EXEC)
1814                         av |= DIR__SEARCH;
1815                 if (mask & MAY_WRITE)
1816                         av |= DIR__WRITE;
1817                 if (mask & MAY_READ)
1818                         av |= DIR__READ;
1819         }
1820
1821         return av;
1822 }
1823
1824 /* Convert a Linux file to an access vector. */
1825 static inline u32 file_to_av(struct file *file)
1826 {
1827         u32 av = 0;
1828
1829         if (file->f_mode & FMODE_READ)
1830                 av |= FILE__READ;
1831         if (file->f_mode & FMODE_WRITE) {
1832                 if (file->f_flags & O_APPEND)
1833                         av |= FILE__APPEND;
1834                 else
1835                         av |= FILE__WRITE;
1836         }
1837         if (!av) {
1838                 /*
1839                  * Special file opened with flags 3 for ioctl-only use.
1840                  */
1841                 av = FILE__IOCTL;
1842         }
1843
1844         return av;
1845 }
1846
1847 /*
1848  * Convert a file to an access vector and include the correct open
1849  * open permission.
1850  */
1851 static inline u32 open_file_to_av(struct file *file)
1852 {
1853         u32 av = file_to_av(file);
1854
1855         if (selinux_policycap_openperm)
1856                 av |= FILE__OPEN;
1857
1858         return av;
1859 }
1860
1861 /* Hook functions begin here. */
1862
1863 static int selinux_ptrace_access_check(struct task_struct *child,
1864                                      unsigned int mode)
1865 {
1866         int rc;
1867
1868         rc = cap_ptrace_access_check(child, mode);
1869         if (rc)
1870                 return rc;
1871
1872         if (mode & PTRACE_MODE_READ) {
1873                 u32 sid = current_sid();
1874                 u32 csid = task_sid(child);
1875                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1876         }
1877
1878         return current_has_perm(child, PROCESS__PTRACE);
1879 }
1880
1881 static int selinux_ptrace_traceme(struct task_struct *parent)
1882 {
1883         int rc;
1884
1885         rc = cap_ptrace_traceme(parent);
1886         if (rc)
1887                 return rc;
1888
1889         return task_has_perm(parent, current, PROCESS__PTRACE);
1890 }
1891
1892 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1893                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1894 {
1895         int error;
1896
1897         error = current_has_perm(target, PROCESS__GETCAP);
1898         if (error)
1899                 return error;
1900
1901         return cap_capget(target, effective, inheritable, permitted);
1902 }
1903
1904 static int selinux_capset(struct cred *new, const struct cred *old,
1905                           const kernel_cap_t *effective,
1906                           const kernel_cap_t *inheritable,
1907                           const kernel_cap_t *permitted)
1908 {
1909         int error;
1910
1911         error = cap_capset(new, old,
1912                                       effective, inheritable, permitted);
1913         if (error)
1914                 return error;
1915
1916         return cred_has_perm(old, new, PROCESS__SETCAP);
1917 }
1918
1919 /*
1920  * (This comment used to live with the selinux_task_setuid hook,
1921  * which was removed).
1922  *
1923  * Since setuid only affects the current process, and since the SELinux
1924  * controls are not based on the Linux identity attributes, SELinux does not
1925  * need to control this operation.  However, SELinux does control the use of
1926  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1927  */
1928
1929 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1930                            int cap, int audit)
1931 {
1932         int rc;
1933
1934         rc = cap_capable(cred, ns, cap, audit);
1935         if (rc)
1936                 return rc;
1937
1938         return cred_has_capability(cred, cap, audit);
1939 }
1940
1941 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1942 {
1943         const struct cred *cred = current_cred();
1944         int rc = 0;
1945
1946         if (!sb)
1947                 return 0;
1948
1949         switch (cmds) {
1950         case Q_SYNC:
1951         case Q_QUOTAON:
1952         case Q_QUOTAOFF:
1953         case Q_SETINFO:
1954         case Q_SETQUOTA:
1955                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1956                 break;
1957         case Q_GETFMT:
1958         case Q_GETINFO:
1959         case Q_GETQUOTA:
1960                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1961                 break;
1962         default:
1963                 rc = 0;  /* let the kernel handle invalid cmds */
1964                 break;
1965         }
1966         return rc;
1967 }
1968
1969 static int selinux_quota_on(struct dentry *dentry)
1970 {
1971         const struct cred *cred = current_cred();
1972
1973         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1974 }
1975
1976 static int selinux_syslog(int type)
1977 {
1978         int rc;
1979
1980         switch (type) {
1981         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1982         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1983                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1984                 break;
1985         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1986         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1987         /* Set level of messages printed to console */
1988         case SYSLOG_ACTION_CONSOLE_LEVEL:
1989                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1990                 break;
1991         case SYSLOG_ACTION_CLOSE:       /* Close log */
1992         case SYSLOG_ACTION_OPEN:        /* Open log */
1993         case SYSLOG_ACTION_READ:        /* Read from log */
1994         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1995         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1996         default:
1997                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1998                 break;
1999         }
2000         return rc;
2001 }
2002
2003 /*
2004  * Check that a process has enough memory to allocate a new virtual
2005  * mapping. 0 means there is enough memory for the allocation to
2006  * succeed and -ENOMEM implies there is not.
2007  *
2008  * Do not audit the selinux permission check, as this is applied to all
2009  * processes that allocate mappings.
2010  */
2011 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2012 {
2013         int rc, cap_sys_admin = 0;
2014
2015         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2016                              SECURITY_CAP_NOAUDIT);
2017         if (rc == 0)
2018                 cap_sys_admin = 1;
2019
2020         return __vm_enough_memory(mm, pages, cap_sys_admin);
2021 }
2022
2023 /* binprm security operations */
2024
2025 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2026 {
2027         const struct task_security_struct *old_tsec;
2028         struct task_security_struct *new_tsec;
2029         struct inode_security_struct *isec;
2030         struct common_audit_data ad;
2031         struct inode *inode = file_inode(bprm->file);
2032         int rc;
2033
2034         rc = cap_bprm_set_creds(bprm);
2035         if (rc)
2036                 return rc;
2037
2038         /* SELinux context only depends on initial program or script and not
2039          * the script interpreter */
2040         if (bprm->cred_prepared)
2041                 return 0;
2042
2043         old_tsec = current_security();
2044         new_tsec = bprm->cred->security;
2045         isec = inode->i_security;
2046
2047         /* Default to the current task SID. */
2048         new_tsec->sid = old_tsec->sid;
2049         new_tsec->osid = old_tsec->sid;
2050
2051         /* Reset fs, key, and sock SIDs on execve. */
2052         new_tsec->create_sid = 0;
2053         new_tsec->keycreate_sid = 0;
2054         new_tsec->sockcreate_sid = 0;
2055
2056         if (old_tsec->exec_sid) {
2057                 new_tsec->sid = old_tsec->exec_sid;
2058                 /* Reset exec SID on execve. */
2059                 new_tsec->exec_sid = 0;
2060
2061                 /*
2062                  * Minimize confusion: if no_new_privs and a transition is
2063                  * explicitly requested, then fail the exec.
2064                  */
2065                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2066                         return -EPERM;
2067         } else {
2068                 /* Check for a default transition on this program. */
2069                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2070                                              SECCLASS_PROCESS, NULL,
2071                                              &new_tsec->sid);
2072                 if (rc)
2073                         return rc;
2074         }
2075
2076         ad.type = LSM_AUDIT_DATA_PATH;
2077         ad.u.path = bprm->file->f_path;
2078
2079         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2080             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2081                 new_tsec->sid = old_tsec->sid;
2082
2083         if (new_tsec->sid == old_tsec->sid) {
2084                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2085                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2086                 if (rc)
2087                         return rc;
2088         } else {
2089                 /* Check permissions for the transition. */
2090                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2091                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2092                 if (rc)
2093                         return rc;
2094
2095                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2096                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2097                 if (rc)
2098                         return rc;
2099
2100                 /* Check for shared state */
2101                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2102                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2103                                           SECCLASS_PROCESS, PROCESS__SHARE,
2104                                           NULL);
2105                         if (rc)
2106                                 return -EPERM;
2107                 }
2108
2109                 /* Make sure that anyone attempting to ptrace over a task that
2110                  * changes its SID has the appropriate permit */
2111                 if (bprm->unsafe &
2112                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2113                         struct task_struct *tracer;
2114                         struct task_security_struct *sec;
2115                         u32 ptsid = 0;
2116
2117                         rcu_read_lock();
2118                         tracer = ptrace_parent(current);
2119                         if (likely(tracer != NULL)) {
2120                                 sec = __task_cred(tracer)->security;
2121                                 ptsid = sec->sid;
2122                         }
2123                         rcu_read_unlock();
2124
2125                         if (ptsid != 0) {
2126                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2127                                                   SECCLASS_PROCESS,
2128                                                   PROCESS__PTRACE, NULL);
2129                                 if (rc)
2130                                         return -EPERM;
2131                         }
2132                 }
2133
2134                 /* Clear any possibly unsafe personality bits on exec: */
2135                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2136         }
2137
2138         return 0;
2139 }
2140
2141 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2142 {
2143         const struct task_security_struct *tsec = current_security();
2144         u32 sid, osid;
2145         int atsecure = 0;
2146
2147         sid = tsec->sid;
2148         osid = tsec->osid;
2149
2150         if (osid != sid) {
2151                 /* Enable secure mode for SIDs transitions unless
2152                    the noatsecure permission is granted between
2153                    the two SIDs, i.e. ahp returns 0. */
2154                 atsecure = avc_has_perm(osid, sid,
2155                                         SECCLASS_PROCESS,
2156                                         PROCESS__NOATSECURE, NULL);
2157         }
2158
2159         return (atsecure || cap_bprm_secureexec(bprm));
2160 }
2161
2162 static int match_file(const void *p, struct file *file, unsigned fd)
2163 {
2164         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2165 }
2166
2167 /* Derived from fs/exec.c:flush_old_files. */
2168 static inline void flush_unauthorized_files(const struct cred *cred,
2169                                             struct files_struct *files)
2170 {
2171         struct file *file, *devnull = NULL;
2172         struct tty_struct *tty;
2173         int drop_tty = 0;
2174         unsigned n;
2175
2176         tty = get_current_tty();
2177         if (tty) {
2178                 spin_lock(&tty_files_lock);
2179                 if (!list_empty(&tty->tty_files)) {
2180                         struct tty_file_private *file_priv;
2181
2182                         /* Revalidate access to controlling tty.
2183                            Use path_has_perm on the tty path directly rather
2184                            than using file_has_perm, as this particular open
2185                            file may belong to another process and we are only
2186                            interested in the inode-based check here. */
2187                         file_priv = list_first_entry(&tty->tty_files,
2188                                                 struct tty_file_private, list);
2189                         file = file_priv->file;
2190                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2191                                 drop_tty = 1;
2192                 }
2193                 spin_unlock(&tty_files_lock);
2194                 tty_kref_put(tty);
2195         }
2196         /* Reset controlling tty. */
2197         if (drop_tty)
2198                 no_tty();
2199
2200         /* Revalidate access to inherited open files. */
2201         n = iterate_fd(files, 0, match_file, cred);
2202         if (!n) /* none found? */
2203                 return;
2204
2205         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2206         if (IS_ERR(devnull))
2207                 devnull = NULL;
2208         /* replace all the matching ones with this */
2209         do {
2210                 replace_fd(n - 1, devnull, 0);
2211         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2212         if (devnull)
2213                 fput(devnull);
2214 }
2215
2216 /*
2217  * Prepare a process for imminent new credential changes due to exec
2218  */
2219 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2220 {
2221         struct task_security_struct *new_tsec;
2222         struct rlimit *rlim, *initrlim;
2223         int rc, i;
2224
2225         new_tsec = bprm->cred->security;
2226         if (new_tsec->sid == new_tsec->osid)
2227                 return;
2228
2229         /* Close files for which the new task SID is not authorized. */
2230         flush_unauthorized_files(bprm->cred, current->files);
2231
2232         /* Always clear parent death signal on SID transitions. */
2233         current->pdeath_signal = 0;
2234
2235         /* Check whether the new SID can inherit resource limits from the old
2236          * SID.  If not, reset all soft limits to the lower of the current
2237          * task's hard limit and the init task's soft limit.
2238          *
2239          * Note that the setting of hard limits (even to lower them) can be
2240          * controlled by the setrlimit check.  The inclusion of the init task's
2241          * soft limit into the computation is to avoid resetting soft limits
2242          * higher than the default soft limit for cases where the default is
2243          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2244          */
2245         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2246                           PROCESS__RLIMITINH, NULL);
2247         if (rc) {
2248                 /* protect against do_prlimit() */
2249                 task_lock(current);
2250                 for (i = 0; i < RLIM_NLIMITS; i++) {
2251                         rlim = current->signal->rlim + i;
2252                         initrlim = init_task.signal->rlim + i;
2253                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2254                 }
2255                 task_unlock(current);
2256                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2257         }
2258 }
2259
2260 /*
2261  * Clean up the process immediately after the installation of new credentials
2262  * due to exec
2263  */
2264 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2265 {
2266         const struct task_security_struct *tsec = current_security();
2267         struct itimerval itimer;
2268         u32 osid, sid;
2269         int rc, i;
2270
2271         osid = tsec->osid;
2272         sid = tsec->sid;
2273
2274         if (sid == osid)
2275                 return;
2276
2277         /* Check whether the new SID can inherit signal state from the old SID.
2278          * If not, clear itimers to avoid subsequent signal generation and
2279          * flush and unblock signals.
2280          *
2281          * This must occur _after_ the task SID has been updated so that any
2282          * kill done after the flush will be checked against the new SID.
2283          */
2284         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2285         if (rc) {
2286                 memset(&itimer, 0, sizeof itimer);
2287                 for (i = 0; i < 3; i++)
2288                         do_setitimer(i, &itimer, NULL);
2289                 spin_lock_irq(&current->sighand->siglock);
2290                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2291                         __flush_signals(current);
2292                         flush_signal_handlers(current, 1);
2293                         sigemptyset(&current->blocked);
2294                 }
2295                 spin_unlock_irq(&current->sighand->siglock);
2296         }
2297
2298         /* Wake up the parent if it is waiting so that it can recheck
2299          * wait permission to the new task SID. */
2300         read_lock(&tasklist_lock);
2301         __wake_up_parent(current, current->real_parent);
2302         read_unlock(&tasklist_lock);
2303 }
2304
2305 /* superblock security operations */
2306
2307 static int selinux_sb_alloc_security(struct super_block *sb)
2308 {
2309         return superblock_alloc_security(sb);
2310 }
2311
2312 static void selinux_sb_free_security(struct super_block *sb)
2313 {
2314         superblock_free_security(sb);
2315 }
2316
2317 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2318 {
2319         if (plen > olen)
2320                 return 0;
2321
2322         return !memcmp(prefix, option, plen);
2323 }
2324
2325 static inline int selinux_option(char *option, int len)
2326 {
2327         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2328                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2329                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2330                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2331                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2332 }
2333
2334 static inline void take_option(char **to, char *from, int *first, int len)
2335 {
2336         if (!*first) {
2337                 **to = ',';
2338                 *to += 1;
2339         } else
2340                 *first = 0;
2341         memcpy(*to, from, len);
2342         *to += len;
2343 }
2344
2345 static inline void take_selinux_option(char **to, char *from, int *first,
2346                                        int len)
2347 {
2348         int current_size = 0;
2349
2350         if (!*first) {
2351                 **to = '|';
2352                 *to += 1;
2353         } else
2354                 *first = 0;
2355
2356         while (current_size < len) {
2357                 if (*from != '"') {
2358                         **to = *from;
2359                         *to += 1;
2360                 }
2361                 from += 1;
2362                 current_size += 1;
2363         }
2364 }
2365
2366 static int selinux_sb_copy_data(char *orig, char *copy)
2367 {
2368         int fnosec, fsec, rc = 0;
2369         char *in_save, *in_curr, *in_end;
2370         char *sec_curr, *nosec_save, *nosec;
2371         int open_quote = 0;
2372
2373         in_curr = orig;
2374         sec_curr = copy;
2375
2376         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2377         if (!nosec) {
2378                 rc = -ENOMEM;
2379                 goto out;
2380         }
2381
2382         nosec_save = nosec;
2383         fnosec = fsec = 1;
2384         in_save = in_end = orig;
2385
2386         do {
2387                 if (*in_end == '"')
2388                         open_quote = !open_quote;
2389                 if ((*in_end == ',' && open_quote == 0) ||
2390                                 *in_end == '\0') {
2391                         int len = in_end - in_curr;
2392
2393                         if (selinux_option(in_curr, len))
2394                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2395                         else
2396                                 take_option(&nosec, in_curr, &fnosec, len);
2397
2398                         in_curr = in_end + 1;
2399                 }
2400         } while (*in_end++);
2401
2402         strcpy(in_save, nosec_save);
2403         free_page((unsigned long)nosec_save);
2404 out:
2405         return rc;
2406 }
2407
2408 static int selinux_sb_remount(struct super_block *sb, void *data)
2409 {
2410         int rc, i, *flags;
2411         struct security_mnt_opts opts;
2412         char *secdata, **mount_options;
2413         struct superblock_security_struct *sbsec = sb->s_security;
2414
2415         if (!(sbsec->flags & SE_SBINITIALIZED))
2416                 return 0;
2417
2418         if (!data)
2419                 return 0;
2420
2421         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2422                 return 0;
2423
2424         security_init_mnt_opts(&opts);
2425         secdata = alloc_secdata();
2426         if (!secdata)
2427                 return -ENOMEM;
2428         rc = selinux_sb_copy_data(data, secdata);
2429         if (rc)
2430                 goto out_free_secdata;
2431
2432         rc = selinux_parse_opts_str(secdata, &opts);
2433         if (rc)
2434                 goto out_free_secdata;
2435
2436         mount_options = opts.mnt_opts;
2437         flags = opts.mnt_opts_flags;
2438
2439         for (i = 0; i < opts.num_mnt_opts; i++) {
2440                 u32 sid;
2441                 size_t len;
2442
2443                 if (flags[i] == SBLABEL_MNT)
2444                         continue;
2445                 len = strlen(mount_options[i]);
2446                 rc = security_context_to_sid(mount_options[i], len, &sid);
2447                 if (rc) {
2448                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2449                                "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
2450                                mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
2451                         goto out_free_opts;
2452                 }
2453                 rc = -EINVAL;
2454                 switch (flags[i]) {
2455                 case FSCONTEXT_MNT:
2456                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2457                                 goto out_bad_option;
2458                         break;
2459                 case CONTEXT_MNT:
2460                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2461                                 goto out_bad_option;
2462                         break;
2463                 case ROOTCONTEXT_MNT: {
2464                         struct inode_security_struct *root_isec;
2465                         root_isec = sb->s_root->d_inode->i_security;
2466
2467                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2468                                 goto out_bad_option;
2469                         break;
2470                 }
2471                 case DEFCONTEXT_MNT:
2472                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2473                                 goto out_bad_option;
2474                         break;
2475                 default:
2476                         goto out_free_opts;
2477                 }
2478         }
2479
2480         rc = 0;
2481 out_free_opts:
2482         security_free_mnt_opts(&opts);
2483 out_free_secdata:
2484         free_secdata(secdata);
2485         return rc;
2486 out_bad_option:
2487         printk(KERN_WARNING "SELinux: unable to change security options "
2488                "during remount (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
2489                SB_TYPE_ARGS(sb));
2490         goto out_free_opts;
2491 }
2492
2493 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2494 {
2495         const struct cred *cred = current_cred();
2496         struct common_audit_data ad;
2497         int rc;
2498
2499         rc = superblock_doinit(sb, data);
2500         if (rc)
2501                 return rc;
2502
2503         /* Allow all mounts performed by the kernel */
2504         if (flags & MS_KERNMOUNT)
2505                 return 0;
2506
2507         ad.type = LSM_AUDIT_DATA_DENTRY;
2508         ad.u.dentry = sb->s_root;
2509         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2510 }
2511
2512 static int selinux_sb_statfs(struct dentry *dentry)
2513 {
2514         const struct cred *cred = current_cred();
2515         struct common_audit_data ad;
2516
2517         ad.type = LSM_AUDIT_DATA_DENTRY;
2518         ad.u.dentry = dentry->d_sb->s_root;
2519         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2520 }
2521
2522 static int selinux_mount(const char *dev_name,
2523                          struct path *path,
2524                          const char *type,
2525                          unsigned long flags,
2526                          void *data)
2527 {
2528         const struct cred *cred = current_cred();
2529
2530         if (flags & MS_REMOUNT)
2531                 return superblock_has_perm(cred, path->dentry->d_sb,
2532                                            FILESYSTEM__REMOUNT, NULL);
2533         else
2534                 return path_has_perm(cred, path, FILE__MOUNTON);
2535 }
2536
2537 static int selinux_umount(struct vfsmount *mnt, int flags)
2538 {
2539         const struct cred *cred = current_cred();
2540
2541         return superblock_has_perm(cred, mnt->mnt_sb,
2542                                    FILESYSTEM__UNMOUNT, NULL);
2543 }
2544
2545 /* inode security operations */
2546
2547 static int selinux_inode_alloc_security(struct inode *inode)
2548 {
2549         return inode_alloc_security(inode);
2550 }
2551
2552 static void selinux_inode_free_security(struct inode *inode)
2553 {
2554         inode_free_security(inode);
2555 }
2556
2557 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2558                                        const struct qstr *qstr, char **name,
2559                                        void **value, size_t *len)
2560 {
2561         const struct task_security_struct *tsec = current_security();
2562         struct inode_security_struct *dsec;
2563         struct superblock_security_struct *sbsec;
2564         u32 sid, newsid, clen;
2565         int rc;
2566         char *namep = NULL, *context;
2567
2568         dsec = dir->i_security;
2569         sbsec = dir->i_sb->s_security;
2570
2571         sid = tsec->sid;
2572         newsid = tsec->create_sid;
2573
2574         if ((sbsec->flags & SE_SBINITIALIZED) &&
2575             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2576                 newsid = sbsec->mntpoint_sid;
2577         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2578                 rc = security_transition_sid(sid, dsec->sid,
2579                                              inode_mode_to_security_class(inode->i_mode),
2580                                              qstr, &newsid);
2581                 if (rc) {
2582                         printk(KERN_WARNING "%s:  "
2583                                "security_transition_sid failed, rc=%d (dev=%s "
2584                                "ino=%ld)\n",
2585                                __func__,
2586                                -rc, inode->i_sb->s_id, inode->i_ino);
2587                         return rc;
2588                 }
2589         }
2590
2591         /* Possibly defer initialization to selinux_complete_init. */
2592         if (sbsec->flags & SE_SBINITIALIZED) {
2593                 struct inode_security_struct *isec = inode->i_security;
2594                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2595                 isec->sid = newsid;
2596                 isec->initialized = 1;
2597         }
2598
2599         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2600                 return -EOPNOTSUPP;
2601
2602         if (name) {
2603                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2604                 if (!namep)
2605                         return -ENOMEM;
2606                 *name = namep;
2607         }
2608
2609         if (value && len) {
2610                 rc = security_sid_to_context_force(newsid, &context, &clen);
2611                 if (rc) {
2612                         kfree(namep);
2613                         return rc;
2614                 }
2615                 *value = context;
2616                 *len = clen;
2617         }
2618
2619         return 0;
2620 }
2621
2622 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2623 {
2624         return may_create(dir, dentry, SECCLASS_FILE);
2625 }
2626
2627 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2628 {
2629         return may_link(dir, old_dentry, MAY_LINK);
2630 }
2631
2632 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2633 {
2634         return may_link(dir, dentry, MAY_UNLINK);
2635 }
2636
2637 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2638 {
2639         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2640 }
2641
2642 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2643 {
2644         return may_create(dir, dentry, SECCLASS_DIR);
2645 }
2646
2647 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2648 {
2649         return may_link(dir, dentry, MAY_RMDIR);
2650 }
2651
2652 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2653 {
2654         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2655 }
2656
2657 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2658                                 struct inode *new_inode, struct dentry *new_dentry)
2659 {
2660         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2661 }
2662
2663 static int selinux_inode_readlink(struct dentry *dentry)
2664 {
2665         const struct cred *cred = current_cred();
2666
2667         return dentry_has_perm(cred, dentry, FILE__READ);
2668 }
2669
2670 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2671 {
2672         const struct cred *cred = current_cred();
2673
2674         return dentry_has_perm(cred, dentry, FILE__READ);
2675 }
2676
2677 static noinline int audit_inode_permission(struct inode *inode,
2678                                            u32 perms, u32 audited, u32 denied,
2679                                            unsigned flags)
2680 {
2681         struct common_audit_data ad;
2682         struct inode_security_struct *isec = inode->i_security;
2683         int rc;
2684
2685         ad.type = LSM_AUDIT_DATA_INODE;
2686         ad.u.inode = inode;
2687
2688         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2689                             audited, denied, &ad, flags);
2690         if (rc)
2691                 return rc;
2692         return 0;
2693 }
2694
2695 static int selinux_inode_permission(struct inode *inode, int mask)
2696 {
2697         const struct cred *cred = current_cred();
2698         u32 perms;
2699         bool from_access;
2700         unsigned flags = mask & MAY_NOT_BLOCK;
2701         struct inode_security_struct *isec;
2702         u32 sid;
2703         struct av_decision avd;
2704         int rc, rc2;
2705         u32 audited, denied;
2706
2707         from_access = mask & MAY_ACCESS;
2708         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2709
2710         /* No permission to check.  Existence test. */
2711         if (!mask)
2712                 return 0;
2713
2714         validate_creds(cred);
2715
2716         if (unlikely(IS_PRIVATE(inode)))
2717                 return 0;
2718
2719         perms = file_mask_to_av(inode->i_mode, mask);
2720
2721         sid = cred_sid(cred);
2722         isec = inode->i_security;
2723
2724         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2725         audited = avc_audit_required(perms, &avd, rc,
2726                                      from_access ? FILE__AUDIT_ACCESS : 0,
2727                                      &denied);
2728         if (likely(!audited))
2729                 return rc;
2730
2731         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2732         if (rc2)
2733                 return rc2;
2734         return rc;
2735 }
2736
2737 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2738 {
2739         const struct cred *cred = current_cred();
2740         unsigned int ia_valid = iattr->ia_valid;
2741         __u32 av = FILE__WRITE;
2742
2743         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2744         if (ia_valid & ATTR_FORCE) {
2745                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2746                               ATTR_FORCE);
2747                 if (!ia_valid)
2748                         return 0;
2749         }
2750
2751         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2752                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2753                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2754
2755         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2756                 av |= FILE__OPEN;
2757
2758         return dentry_has_perm(cred, dentry, av);
2759 }
2760
2761 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2762 {
2763         const struct cred *cred = current_cred();
2764         struct path path;
2765
2766         path.dentry = dentry;
2767         path.mnt = mnt;
2768
2769         return path_has_perm(cred, &path, FILE__GETATTR);
2770 }
2771
2772 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2773 {
2774         const struct cred *cred = current_cred();
2775
2776         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2777                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2778                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2779                         if (!capable(CAP_SETFCAP))
2780                                 return -EPERM;
2781                 } else if (!capable(CAP_SYS_ADMIN)) {
2782                         /* A different attribute in the security namespace.
2783                            Restrict to administrator. */
2784                         return -EPERM;
2785                 }
2786         }
2787
2788         /* Not an attribute we recognize, so just check the
2789            ordinary setattr permission. */
2790         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2791 }
2792
2793 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2794                                   const void *value, size_t size, int flags)
2795 {
2796         struct inode *inode = dentry->d_inode;
2797         struct inode_security_struct *isec = inode->i_security;
2798         struct superblock_security_struct *sbsec;
2799         struct common_audit_data ad;
2800         u32 newsid, sid = current_sid();
2801         int rc = 0;
2802
2803         if (strcmp(name, XATTR_NAME_SELINUX))
2804                 return selinux_inode_setotherxattr(dentry, name);
2805
2806         sbsec = inode->i_sb->s_security;
2807         if (!(sbsec->flags & SBLABEL_MNT))
2808                 return -EOPNOTSUPP;
2809
2810         if (!inode_owner_or_capable(inode))
2811                 return -EPERM;
2812
2813         ad.type = LSM_AUDIT_DATA_DENTRY;
2814         ad.u.dentry = dentry;
2815
2816         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2817                           FILE__RELABELFROM, &ad);
2818         if (rc)
2819                 return rc;
2820
2821         rc = security_context_to_sid(value, size, &newsid);
2822         if (rc == -EINVAL) {
2823                 if (!capable(CAP_MAC_ADMIN)) {
2824                         struct audit_buffer *ab;
2825                         size_t audit_size;
2826                         const char *str;
2827
2828                         /* We strip a nul only if it is at the end, otherwise the
2829                          * context contains a nul and we should audit that */
2830                         if (value) {
2831                                 str = value;
2832                                 if (str[size - 1] == '\0')
2833                                         audit_size = size - 1;
2834                                 else
2835                                         audit_size = size;
2836                         } else {
2837                                 str = "";
2838                                 audit_size = 0;
2839                         }
2840                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2841                         audit_log_format(ab, "op=setxattr invalid_context=");
2842                         audit_log_n_untrustedstring(ab, value, audit_size);
2843                         audit_log_end(ab);
2844
2845                         return rc;
2846                 }
2847                 rc = security_context_to_sid_force(value, size, &newsid);
2848         }
2849         if (rc)
2850                 return rc;
2851
2852         rc = avc_has_perm(sid, newsid, isec->sclass,
2853                           FILE__RELABELTO, &ad);
2854         if (rc)
2855                 return rc;
2856
2857         rc = security_validate_transition(isec->sid, newsid, sid,
2858                                           isec->sclass);
2859         if (rc)
2860                 return rc;
2861
2862         return avc_has_perm(newsid,
2863                             sbsec->sid,
2864                             SECCLASS_FILESYSTEM,
2865                             FILESYSTEM__ASSOCIATE,
2866                             &ad);
2867 }
2868
2869 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2870                                         const void *value, size_t size,
2871                                         int flags)
2872 {
2873         struct inode *inode = dentry->d_inode;
2874         struct inode_security_struct *isec = inode->i_security;
2875         u32 newsid;
2876         int rc;
2877
2878         if (strcmp(name, XATTR_NAME_SELINUX)) {
2879                 /* Not an attribute we recognize, so nothing to do. */
2880                 return;
2881         }
2882
2883         rc = security_context_to_sid_force(value, size, &newsid);
2884         if (rc) {
2885                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2886                        "for (%s, %lu), rc=%d\n",
2887                        inode->i_sb->s_id, inode->i_ino, -rc);
2888                 return;
2889         }
2890
2891         isec->sid = newsid;
2892         return;
2893 }
2894
2895 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2896 {
2897         const struct cred *cred = current_cred();
2898
2899         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2900 }
2901
2902 static int selinux_inode_listxattr(struct dentry *dentry)
2903 {
2904         const struct cred *cred = current_cred();
2905
2906         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2907 }
2908
2909 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2910 {
2911         if (strcmp(name, XATTR_NAME_SELINUX))
2912                 return selinux_inode_setotherxattr(dentry, name);
2913
2914         /* No one is allowed to remove a SELinux security label.
2915            You can change the label, but all data must be labeled. */
2916         return -EACCES;
2917 }
2918
2919 /*
2920  * Copy the inode security context value to the user.
2921  *
2922  * Permission check is handled by selinux_inode_getxattr hook.
2923  */
2924 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2925 {
2926         u32 size;
2927         int error;
2928         char *context = NULL;
2929         struct inode_security_struct *isec = inode->i_security;
2930
2931         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2932                 return -EOPNOTSUPP;
2933
2934         /*
2935          * If the caller has CAP_MAC_ADMIN, then get the raw context
2936          * value even if it is not defined by current policy; otherwise,
2937          * use the in-core value under current policy.
2938          * Use the non-auditing forms of the permission checks since
2939          * getxattr may be called by unprivileged processes commonly
2940          * and lack of permission just means that we fall back to the
2941          * in-core context value, not a denial.
2942          */
2943         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2944                                 SECURITY_CAP_NOAUDIT);
2945         if (!error)
2946                 error = security_sid_to_context_force(isec->sid, &context,
2947                                                       &size);
2948         else
2949                 error = security_sid_to_context(isec->sid, &context, &size);
2950         if (error)
2951                 return error;
2952         error = size;
2953         if (alloc) {
2954                 *buffer = context;
2955                 goto out_nofree;
2956         }
2957         kfree(context);
2958 out_nofree:
2959         return error;
2960 }
2961
2962 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2963                                      const void *value, size_t size, int flags)
2964 {
2965         struct inode_security_struct *isec = inode->i_security;
2966         u32 newsid;
2967         int rc;
2968
2969         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2970                 return -EOPNOTSUPP;
2971
2972         if (!value || !size)
2973                 return -EACCES;
2974
2975         rc = security_context_to_sid((void *)value, size, &newsid);
2976         if (rc)
2977                 return rc;
2978
2979         isec->sid = newsid;
2980         isec->initialized = 1;
2981         return 0;
2982 }
2983
2984 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2985 {
2986         const int len = sizeof(XATTR_NAME_SELINUX);
2987         if (buffer && len <= buffer_size)
2988                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2989         return len;
2990 }
2991
2992 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2993 {
2994         struct inode_security_struct *isec = inode->i_security;
2995         *secid = isec->sid;
2996 }
2997
2998 /* file security operations */
2999
3000 static int selinux_revalidate_file_permission(struct file *file, int mask)
3001 {
3002         const struct cred *cred = current_cred();
3003         struct inode *inode = file_inode(file);
3004
3005         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3006         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3007                 mask |= MAY_APPEND;
3008
3009         return file_has_perm(cred, file,
3010                              file_mask_to_av(inode->i_mode, mask));
3011 }
3012
3013 static int selinux_file_permission(struct file *file, int mask)
3014 {
3015         struct inode *inode = file_inode(file);
3016         struct file_security_struct *fsec = file->f_security;
3017         struct inode_security_struct *isec = inode->i_security;
3018         u32 sid = current_sid();
3019
3020         if (!mask)
3021                 /* No permission to check.  Existence test. */
3022                 return 0;
3023
3024         if (sid == fsec->sid && fsec->isid == isec->sid &&
3025             fsec->pseqno == avc_policy_seqno())
3026                 /* No change since file_open check. */
3027                 return 0;
3028
3029         return selinux_revalidate_file_permission(file, mask);
3030 }
3031
3032 static int selinux_file_alloc_security(struct file *file)
3033 {
3034         return file_alloc_security(file);
3035 }
3036
3037 static void selinux_file_free_security(struct file *file)
3038 {
3039         file_free_security(file);
3040 }
3041
3042 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3043                               unsigned long arg)
3044 {
3045         const struct cred *cred = current_cred();
3046         int error = 0;
3047
3048         switch (cmd) {
3049         case FIONREAD:
3050         /* fall through */
3051         case FIBMAP:
3052         /* fall through */
3053         case FIGETBSZ:
3054         /* fall through */
3055         case FS_IOC_GETFLAGS:
3056         /* fall through */
3057         case FS_IOC_GETVERSION:
3058                 error = file_has_perm(cred, file, FILE__GETATTR);
3059                 break;
3060
3061         case FS_IOC_SETFLAGS:
3062         /* fall through */
3063         case FS_IOC_SETVERSION:
3064                 error = file_has_perm(cred, file, FILE__SETATTR);
3065                 break;
3066
3067         /* sys_ioctl() checks */
3068         case FIONBIO:
3069         /* fall through */
3070         case FIOASYNC:
3071                 error = file_has_perm(cred, file, 0);
3072                 break;
3073
3074         case KDSKBENT:
3075         case KDSKBSENT:
3076                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3077                                             SECURITY_CAP_AUDIT);
3078                 break;
3079
3080         /* default case assumes that the command will go
3081          * to the file's ioctl() function.
3082          */
3083         default:
3084                 error = file_has_perm(cred, file, FILE__IOCTL);
3085         }
3086         return error;
3087 }
3088
3089 static int default_noexec;
3090
3091 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3092 {
3093         const struct cred *cred = current_cred();
3094         int rc = 0;
3095
3096         if (default_noexec &&
3097             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3098                 /*
3099                  * We are making executable an anonymous mapping or a
3100                  * private file mapping that will also be writable.
3101                  * This has an additional check.
3102                  */
3103                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3104                 if (rc)
3105                         goto error;
3106         }
3107
3108         if (file) {
3109                 /* read access is always possible with a mapping */
3110                 u32 av = FILE__READ;
3111
3112                 /* write access only matters if the mapping is shared */
3113                 if (shared && (prot & PROT_WRITE))
3114                         av |= FILE__WRITE;
3115
3116                 if (prot & PROT_EXEC)
3117                         av |= FILE__EXECUTE;
3118
3119                 return file_has_perm(cred, file, av);
3120         }
3121
3122 error:
3123         return rc;
3124 }
3125
3126 static int selinux_mmap_addr(unsigned long addr)
3127 {
3128         int rc = 0;
3129         u32 sid = current_sid();
3130
3131         /*
3132          * notice that we are intentionally putting the SELinux check before
3133          * the secondary cap_file_mmap check.  This is such a likely attempt
3134          * at bad behaviour/exploit that we always want to get the AVC, even
3135          * if DAC would have also denied the operation.
3136          */
3137         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3138                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3139                                   MEMPROTECT__MMAP_ZERO, NULL);
3140                 if (rc)
3141                         return rc;
3142         }
3143
3144         /* do DAC check on address space usage */
3145         return cap_mmap_addr(addr);
3146 }
3147
3148 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3149                              unsigned long prot, unsigned long flags)
3150 {
3151         if (selinux_checkreqprot)
3152                 prot = reqprot;
3153
3154         return file_map_prot_check(file, prot,
3155                                    (flags & MAP_TYPE) == MAP_SHARED);
3156 }
3157
3158 static int selinux_file_mprotect(struct vm_area_struct *vma,
3159                                  unsigned long reqprot,
3160                                  unsigned long prot)
3161 {
3162         const struct cred *cred = current_cred();
3163
3164         if (selinux_checkreqprot)
3165                 prot = reqprot;
3166
3167         if (default_noexec &&
3168             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3169                 int rc = 0;
3170                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3171                     vma->vm_end <= vma->vm_mm->brk) {
3172                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3173                 } else if (!vma->vm_file &&
3174                            vma->vm_start <= vma->vm_mm->start_stack &&
3175                            vma->vm_end >= vma->vm_mm->start_stack) {
3176                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3177                 } else if (vma->vm_file && vma->anon_vma) {
3178                         /*
3179                          * We are making executable a file mapping that has
3180                          * had some COW done. Since pages might have been
3181                          * written, check ability to execute the possibly
3182                          * modified content.  This typically should only
3183                          * occur for text relocations.
3184                          */
3185                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3186                 }
3187                 if (rc)
3188                         return rc;
3189         }
3190
3191         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3192 }
3193
3194 static int selinux_file_lock(struct file *file, unsigned int cmd)
3195 {
3196         const struct cred *cred = current_cred();
3197
3198         return file_has_perm(cred, file, FILE__LOCK);
3199 }
3200
3201 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3202                               unsigned long arg)
3203 {
3204         const struct cred *cred = current_cred();
3205         int err = 0;
3206
3207         switch (cmd) {
3208         case F_SETFL:
3209                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3210                         err = file_has_perm(cred, file, FILE__WRITE);
3211                         break;
3212                 }
3213                 /* fall through */
3214         case F_SETOWN:
3215         case F_SETSIG:
3216         case F_GETFL:
3217         case F_GETOWN:
3218         case F_GETSIG:
3219         case F_GETOWNER_UIDS:
3220                 /* Just check FD__USE permission */
3221                 err = file_has_perm(cred, file, 0);
3222                 break;
3223         case F_GETLK:
3224         case F_SETLK:
3225         case F_SETLKW:
3226 #if BITS_PER_LONG == 32
3227         case F_GETLK64:
3228         case F_SETLK64:
3229         case F_SETLKW64:
3230 #endif
3231                 err = file_has_perm(cred, file, FILE__LOCK);
3232                 break;
3233         }
3234
3235         return err;
3236 }
3237
3238 static int selinux_file_set_fowner(struct file *file)
3239 {
3240         struct file_security_struct *fsec;
3241
3242         fsec = file->f_security;
3243         fsec->fown_sid = current_sid();
3244
3245         return 0;
3246 }
3247
3248 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3249                                        struct fown_struct *fown, int signum)
3250 {
3251         struct file *file;
3252         u32 sid = task_sid(tsk);
3253         u32 perm;
3254         struct file_security_struct *fsec;
3255
3256         /* struct fown_struct is never outside the context of a struct file */
3257         file = container_of(fown, struct file, f_owner);
3258
3259         fsec = file->f_security;
3260
3261         if (!signum)
3262                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3263         else
3264                 perm = signal_to_av(signum);
3265
3266         return avc_has_perm(fsec->fown_sid, sid,
3267                             SECCLASS_PROCESS, perm, NULL);
3268 }
3269
3270 static int selinux_file_receive(struct file *file)
3271 {
3272         const struct cred *cred = current_cred();
3273
3274         return file_has_perm(cred, file, file_to_av(file));
3275 }
3276
3277 static int selinux_file_open(struct file *file, const struct cred *cred)
3278 {
3279         struct file_security_struct *fsec;
3280         struct inode_security_struct *isec;
3281
3282         fsec = file->f_security;
3283         isec = file_inode(file)->i_security;
3284         /*
3285          * Save inode label and policy sequence number
3286          * at open-time so that selinux_file_permission
3287          * can determine whether revalidation is necessary.
3288          * Task label is already saved in the file security
3289          * struct as its SID.
3290          */
3291         fsec->isid = isec->sid;
3292         fsec->pseqno = avc_policy_seqno();
3293         /*
3294          * Since the inode label or policy seqno may have changed
3295          * between the selinux_inode_permission check and the saving
3296          * of state above, recheck that access is still permitted.
3297          * Otherwise, access might never be revalidated against the
3298          * new inode label or new policy.
3299          * This check is not redundant - do not remove.
3300          */
3301         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3302 }
3303
3304 /* task security operations */
3305
3306 static int selinux_task_create(unsigned long clone_flags)
3307 {
3308         return current_has_perm(current, PROCESS__FORK);
3309 }
3310
3311 /*
3312  * allocate the SELinux part of blank credentials
3313  */
3314 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3315 {
3316         struct task_security_struct *tsec;
3317
3318         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3319         if (!tsec)
3320                 return -ENOMEM;
3321
3322         cred->security = tsec;
3323         return 0;
3324 }
3325
3326 /*
3327  * detach and free the LSM part of a set of credentials
3328  */
3329 static void selinux_cred_free(struct cred *cred)
3330 {
3331         struct task_security_struct *tsec = cred->security;
3332
3333         /*
3334          * cred->security == NULL if security_cred_alloc_blank() or
3335          * security_prepare_creds() returned an error.
3336          */
3337         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3338         cred->security = (void *) 0x7UL;
3339         kfree(tsec);
3340 }
3341
3342 /*
3343  * prepare a new set of credentials for modification
3344  */
3345 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3346                                 gfp_t gfp)
3347 {
3348         const struct task_security_struct *old_tsec;
3349         struct task_security_struct *tsec;
3350
3351         old_tsec = old->security;
3352
3353         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3354         if (!tsec)
3355                 return -ENOMEM;
3356
3357         new->security = tsec;
3358         return 0;
3359 }
3360
3361 /*
3362  * transfer the SELinux data to a blank set of creds
3363  */
3364 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3365 {
3366         const struct task_security_struct *old_tsec = old->security;
3367         struct task_security_struct *tsec = new->security;
3368
3369         *tsec = *old_tsec;
3370 }
3371
3372 /*
3373  * set the security data for a kernel service
3374  * - all the creation contexts are set to unlabelled
3375  */
3376 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3377 {
3378         struct task_security_struct *tsec = new->security;
3379         u32 sid = current_sid();
3380         int ret;
3381
3382         ret = avc_has_perm(sid, secid,
3383                            SECCLASS_KERNEL_SERVICE,
3384                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3385                            NULL);
3386         if (ret == 0) {
3387                 tsec->sid = secid;
3388                 tsec->create_sid = 0;
3389                 tsec->keycreate_sid = 0;
3390                 tsec->sockcreate_sid = 0;
3391         }
3392         return ret;
3393 }
3394
3395 /*
3396  * set the file creation context in a security record to the same as the
3397  * objective context of the specified inode
3398  */
3399 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3400 {
3401         struct inode_security_struct *isec = inode->i_security;
3402         struct task_security_struct *tsec = new->security;
3403         u32 sid = current_sid();
3404         int ret;
3405
3406         ret = avc_has_perm(sid, isec->sid,
3407                            SECCLASS_KERNEL_SERVICE,
3408                            KERNEL_SERVICE__CREATE_FILES_AS,
3409                            NULL);
3410
3411         if (ret == 0)
3412                 tsec->create_sid = isec->sid;
3413         return ret;
3414 }
3415
3416 static int selinux_kernel_module_request(char *kmod_name)
3417 {
3418         u32 sid;
3419         struct common_audit_data ad;
3420
3421         sid = task_sid(current);
3422
3423         ad.type = LSM_AUDIT_DATA_KMOD;
3424         ad.u.kmod_name = kmod_name;
3425
3426         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3427                             SYSTEM__MODULE_REQUEST, &ad);
3428 }
3429
3430 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3431 {
3432         return current_has_perm(p, PROCESS__SETPGID);
3433 }
3434
3435 static int selinux_task_getpgid(struct task_struct *p)
3436 {
3437         return current_has_perm(p, PROCESS__GETPGID);
3438 }
3439
3440 static int selinux_task_getsid(struct task_struct *p)
3441 {
3442         return current_has_perm(p, PROCESS__GETSESSION);
3443 }
3444
3445 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3446 {
3447         *secid = task_sid(p);
3448 }
3449
3450 static int selinux_task_setnice(struct task_struct *p, int nice)
3451 {
3452         int rc;
3453
3454         rc = cap_task_setnice(p, nice);
3455         if (rc)
3456                 return rc;
3457
3458         return current_has_perm(p, PROCESS__SETSCHED);
3459 }
3460
3461 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3462 {
3463         int rc;
3464
3465         rc = cap_task_setioprio(p, ioprio);
3466         if (rc)
3467                 return rc;
3468
3469         return current_has_perm(p, PROCESS__SETSCHED);
3470 }
3471
3472 static int selinux_task_getioprio(struct task_struct *p)
3473 {
3474         return current_has_perm(p, PROCESS__GETSCHED);
3475 }
3476
3477 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3478                 struct rlimit *new_rlim)
3479 {
3480         struct rlimit *old_rlim = p->signal->rlim + resource;
3481
3482         /* Control the ability to change the hard limit (whether
3483            lowering or raising it), so that the hard limit can
3484            later be used as a safe reset point for the soft limit
3485            upon context transitions.  See selinux_bprm_committing_creds. */
3486         if (old_rlim->rlim_max != new_rlim->rlim_max)
3487                 return current_has_perm(p, PROCESS__SETRLIMIT);
3488
3489         return 0;
3490 }
3491
3492 static int selinux_task_setscheduler(struct task_struct *p)
3493 {
3494         int rc;
3495
3496         rc = cap_task_setscheduler(p);
3497         if (rc)
3498                 return rc;
3499
3500         return current_has_perm(p, PROCESS__SETSCHED);
3501 }
3502
3503 static int selinux_task_getscheduler(struct task_struct *p)
3504 {
3505         return current_has_perm(p, PROCESS__GETSCHED);
3506 }
3507
3508 static int selinux_task_movememory(struct task_struct *p)
3509 {
3510         return current_has_perm(p, PROCESS__SETSCHED);
3511 }
3512
3513 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3514                                 int sig, u32 secid)
3515 {
3516         u32 perm;
3517         int rc;
3518
3519         if (!sig)
3520                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3521         else
3522                 perm = signal_to_av(sig);
3523         if (secid)
3524                 rc = avc_has_perm(secid, task_sid(p),
3525                                   SECCLASS_PROCESS, perm, NULL);
3526         else
3527                 rc = current_has_perm(p, perm);
3528         return rc;
3529 }
3530
3531 static int selinux_task_wait(struct task_struct *p)
3532 {
3533         return task_has_perm(p, current, PROCESS__SIGCHLD);
3534 }
3535
3536 static void selinux_task_to_inode(struct task_struct *p,
3537                                   struct inode *inode)
3538 {
3539         struct inode_security_struct *isec = inode->i_security;
3540         u32 sid = task_sid(p);
3541
3542         isec->sid = sid;
3543         isec->initialized = 1;
3544 }
3545
3546 /* Returns error only if unable to parse addresses */
3547 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3548                         struct common_audit_data *ad, u8 *proto)
3549 {
3550         int offset, ihlen, ret = -EINVAL;
3551         struct iphdr _iph, *ih;
3552
3553         offset = skb_network_offset(skb);
3554         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3555         if (ih == NULL)
3556                 goto out;
3557
3558         ihlen = ih->ihl * 4;
3559         if (ihlen < sizeof(_iph))
3560                 goto out;
3561
3562         ad->u.net->v4info.saddr = ih->saddr;
3563         ad->u.net->v4info.daddr = ih->daddr;
3564         ret = 0;
3565
3566         if (proto)
3567                 *proto = ih->protocol;
3568
3569         switch (ih->protocol) {
3570         case IPPROTO_TCP: {
3571                 struct tcphdr _tcph, *th;
3572
3573                 if (ntohs(ih->frag_off) & IP_OFFSET)
3574                         break;
3575
3576                 offset += ihlen;
3577                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3578                 if (th == NULL)
3579                         break;
3580
3581                 ad->u.net->sport = th->source;
3582                 ad->u.net->dport = th->dest;
3583                 break;
3584         }
3585
3586         case IPPROTO_UDP: {
3587                 struct udphdr _udph, *uh;
3588
3589                 if (ntohs(ih->frag_off) & IP_OFFSET)
3590                         break;
3591
3592                 offset += ihlen;
3593                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3594                 if (uh == NULL)
3595                         break;
3596
3597                 ad->u.net->sport = uh->source;
3598                 ad->u.net->dport = uh->dest;
3599                 break;
3600         }
3601
3602         case IPPROTO_DCCP: {
3603                 struct dccp_hdr _dccph, *dh;
3604
3605                 if (ntohs(ih->frag_off) & IP_OFFSET)
3606                         break;
3607
3608                 offset += ihlen;
3609                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3610                 if (dh == NULL)
3611                         break;
3612
3613                 ad->u.net->sport = dh->dccph_sport;
3614                 ad->u.net->dport = dh->dccph_dport;
3615                 break;
3616         }
3617
3618         default:
3619                 break;
3620         }
3621 out:
3622         return ret;
3623 }
3624
3625 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3626
3627 /* Returns error only if unable to parse addresses */
3628 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3629                         struct common_audit_data *ad, u8 *proto)
3630 {
3631         u8 nexthdr;
3632         int ret = -EINVAL, offset;
3633         struct ipv6hdr _ipv6h, *ip6;
3634         __be16 frag_off;
3635
3636         offset = skb_network_offset(skb);
3637         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3638         if (ip6 == NULL)
3639                 goto out;
3640
3641         ad->u.net->v6info.saddr = ip6->saddr;
3642         ad->u.net->v6info.daddr = ip6->daddr;
3643         ret = 0;
3644
3645         nexthdr = ip6->nexthdr;
3646         offset += sizeof(_ipv6h);
3647         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3648         if (offset < 0)
3649                 goto out;
3650
3651         if (proto)
3652                 *proto = nexthdr;
3653
3654         switch (nexthdr) {
3655         case IPPROTO_TCP: {
3656                 struct tcphdr _tcph, *th;
3657
3658                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3659                 if (th == NULL)
3660                         break;
3661
3662                 ad->u.net->sport = th->source;
3663                 ad->u.net->dport = th->dest;
3664                 break;
3665         }
3666
3667         case IPPROTO_UDP: {
3668                 struct udphdr _udph, *uh;
3669
3670                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3671                 if (uh == NULL)
3672                         break;
3673
3674                 ad->u.net->sport = uh->source;
3675                 ad->u.net->dport = uh->dest;
3676                 break;
3677         }
3678
3679         case IPPROTO_DCCP: {
3680                 struct dccp_hdr _dccph, *dh;
3681
3682                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3683                 if (dh == NULL)
3684                         break;
3685
3686                 ad->u.net->sport = dh->dccph_sport;
3687                 ad->u.net->dport = dh->dccph_dport;
3688                 break;
3689         }
3690
3691         /* includes fragments */
3692         default:
3693                 break;
3694         }
3695 out:
3696         return ret;
3697 }
3698
3699 #endif /* IPV6 */
3700
3701 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3702                              char **_addrp, int src, u8 *proto)
3703 {
3704         char *addrp;
3705         int ret;
3706
3707         switch (ad->u.net->family) {
3708         case PF_INET:
3709                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3710                 if (ret)
3711                         goto parse_error;
3712                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3713                                        &ad->u.net->v4info.daddr);
3714                 goto okay;
3715
3716 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3717         case PF_INET6:
3718                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3719                 if (ret)
3720                         goto parse_error;
3721                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3722                                        &ad->u.net->v6info.daddr);
3723                 goto okay;
3724 #endif  /* IPV6 */
3725         default:
3726                 addrp = NULL;
3727                 goto okay;
3728         }
3729
3730 parse_error:
3731         printk(KERN_WARNING
3732                "SELinux: failure in selinux_parse_skb(),"
3733                " unable to parse packet\n");
3734         return ret;
3735
3736 okay:
3737         if (_addrp)
3738                 *_addrp = addrp;
3739         return 0;
3740 }
3741
3742 /**
3743  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3744  * @skb: the packet
3745  * @family: protocol family
3746  * @sid: the packet's peer label SID
3747  *
3748  * Description:
3749  * Check the various different forms of network peer labeling and determine
3750  * the peer label/SID for the packet; most of the magic actually occurs in
3751  * the security server function security_net_peersid_cmp().  The function
3752  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3753  * or -EACCES if @sid is invalid due to inconsistencies with the different
3754  * peer labels.
3755  *
3756  */
3757 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3758 {
3759         int err;
3760         u32 xfrm_sid;
3761         u32 nlbl_sid;
3762         u32 nlbl_type;
3763
3764         err = selinux_skb_xfrm_sid(skb, &xfrm_sid);
3765         if (unlikely(err))
3766                 return -EACCES;
3767         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3768         if (unlikely(err))
3769                 return -EACCES;
3770
3771         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3772         if (unlikely(err)) {
3773                 printk(KERN_WARNING
3774                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3775                        " unable to determine packet's peer label\n");
3776                 return -EACCES;
3777         }
3778
3779         return 0;
3780 }
3781
3782 /* socket security operations */
3783
3784 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3785                                  u16 secclass, u32 *socksid)
3786 {
3787         if (tsec->sockcreate_sid > SECSID_NULL) {
3788                 *socksid = tsec->sockcreate_sid;
3789                 return 0;
3790         }
3791
3792         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3793                                        socksid);
3794 }
3795
3796 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3797 {
3798         struct sk_security_struct *sksec = sk->sk_security;
3799         struct common_audit_data ad;
3800         struct lsm_network_audit net = {0,};
3801         u32 tsid = task_sid(task);
3802
3803         if (sksec->sid == SECINITSID_KERNEL)
3804                 return 0;
3805
3806         ad.type = LSM_AUDIT_DATA_NET;
3807         ad.u.net = &net;
3808         ad.u.net->sk = sk;
3809
3810         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3811 }
3812
3813 static int selinux_socket_create(int family, int type,
3814                                  int protocol, int kern)
3815 {
3816         const struct task_security_struct *tsec = current_security();
3817         u32 newsid;
3818         u16 secclass;
3819         int rc;
3820
3821         if (kern)
3822                 return 0;
3823
3824         secclass = socket_type_to_security_class(family, type, protocol);
3825         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3826         if (rc)
3827                 return rc;
3828
3829         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3830 }
3831
3832 static int selinux_socket_post_create(struct socket *sock, int family,
3833                                       int type, int protocol, int kern)
3834 {
3835         const struct task_security_struct *tsec = current_security();
3836         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3837         struct sk_security_struct *sksec;
3838         int err = 0;
3839
3840         isec->sclass = socket_type_to_security_class(family, type, protocol);
3841
3842         if (kern)
3843                 isec->sid = SECINITSID_KERNEL;
3844         else {
3845                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3846                 if (err)
3847                         return err;
3848         }
3849
3850         isec->initialized = 1;
3851
3852         if (sock->sk) {
3853                 sksec = sock->sk->sk_security;
3854                 sksec->sid = isec->sid;
3855                 sksec->sclass = isec->sclass;
3856                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3857         }
3858
3859         return err;
3860 }
3861
3862 /* Range of port numbers used to automatically bind.
3863    Need to determine whether we should perform a name_bind
3864    permission check between the socket and the port number. */
3865
3866 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3867 {
3868         struct sock *sk = sock->sk;
3869         u16 family;
3870         int err;
3871
3872         err = sock_has_perm(current, sk, SOCKET__BIND);
3873         if (err)
3874                 goto out;
3875
3876         /*
3877          * If PF_INET or PF_INET6, check name_bind permission for the port.
3878          * Multiple address binding for SCTP is not supported yet: we just
3879          * check the first address now.
3880          */
3881         family = sk->sk_family;
3882         if (family == PF_INET || family == PF_INET6) {
3883                 char *addrp;
3884                 struct sk_security_struct *sksec = sk->sk_security;
3885                 struct common_audit_data ad;
3886                 struct lsm_network_audit net = {0,};
3887                 struct sockaddr_in *addr4 = NULL;
3888                 struct sockaddr_in6 *addr6 = NULL;
3889                 unsigned short snum;
3890                 u32 sid, node_perm;
3891
3892                 if (family == PF_INET) {
3893                         addr4 = (struct sockaddr_in *)address;
3894                         snum = ntohs(addr4->sin_port);
3895                         addrp = (char *)&addr4->sin_addr.s_addr;
3896                 } else {
3897                         addr6 = (struct sockaddr_in6 *)address;
3898                         snum = ntohs(addr6->sin6_port);
3899                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3900                 }
3901
3902                 if (snum) {
3903                         int low, high;
3904
3905                         inet_get_local_port_range(&low, &high);
3906
3907                         if (snum < max(PROT_SOCK, low) || snum > high) {
3908                                 err = sel_netport_sid(sk->sk_protocol,
3909                                                       snum, &sid);
3910                                 if (err)
3911                                         goto out;
3912                                 ad.type = LSM_AUDIT_DATA_NET;
3913                                 ad.u.net = &net;
3914                                 ad.u.net->sport = htons(snum);
3915                                 ad.u.net->family = family;
3916                                 err = avc_has_perm(sksec->sid, sid,
3917                                                    sksec->sclass,
3918                                                    SOCKET__NAME_BIND, &ad);
3919                                 if (err)
3920                                         goto out;
3921                         }
3922                 }
3923
3924                 switch (sksec->sclass) {
3925                 case SECCLASS_TCP_SOCKET:
3926                         node_perm = TCP_SOCKET__NODE_BIND;
3927                         break;
3928
3929                 case SECCLASS_UDP_SOCKET:
3930                         node_perm = UDP_SOCKET__NODE_BIND;
3931                         break;
3932
3933                 case SECCLASS_DCCP_SOCKET:
3934                         node_perm = DCCP_SOCKET__NODE_BIND;
3935                         break;
3936
3937                 default:
3938                         node_perm = RAWIP_SOCKET__NODE_BIND;
3939                         break;
3940                 }
3941
3942                 err = sel_netnode_sid(addrp, family, &sid);
3943                 if (err)
3944                         goto out;
3945
3946                 ad.type = LSM_AUDIT_DATA_NET;
3947                 ad.u.net = &net;
3948                 ad.u.net->sport = htons(snum);
3949                 ad.u.net->family = family;
3950
3951                 if (family == PF_INET)
3952                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3953                 else
3954                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3955
3956                 err = avc_has_perm(sksec->sid, sid,
3957                                    sksec->sclass, node_perm, &ad);
3958                 if (err)
3959                         goto out;
3960         }
3961 out:
3962         return err;
3963 }
3964
3965 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3966 {
3967         struct sock *sk = sock->sk;
3968         struct sk_security_struct *sksec = sk->sk_security;
3969         int err;
3970
3971         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3972         if (err)
3973                 return err;
3974
3975         /*
3976          * If a TCP or DCCP socket, check name_connect permission for the port.
3977          */
3978         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3979             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3980                 struct common_audit_data ad;
3981                 struct lsm_network_audit net = {0,};
3982                 struct sockaddr_in *addr4 = NULL;
3983                 struct sockaddr_in6 *addr6 = NULL;
3984                 unsigned short snum;
3985                 u32 sid, perm;
3986
3987                 if (sk->sk_family == PF_INET) {
3988                         addr4 = (struct sockaddr_in *)address;
3989                         if (addrlen < sizeof(struct sockaddr_in))
3990                                 return -EINVAL;
3991                         snum = ntohs(addr4->sin_port);
3992                 } else {
3993                         addr6 = (struct sockaddr_in6 *)address;
3994                         if (addrlen < SIN6_LEN_RFC2133)
3995                                 return -EINVAL;
3996                         snum = ntohs(addr6->sin6_port);
3997                 }
3998
3999                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4000                 if (err)
4001                         goto out;
4002
4003                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4004                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4005
4006                 ad.type = LSM_AUDIT_DATA_NET;
4007                 ad.u.net = &net;
4008                 ad.u.net->dport = htons(snum);
4009                 ad.u.net->family = sk->sk_family;
4010                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4011                 if (err)
4012                         goto out;
4013         }
4014
4015         err = selinux_netlbl_socket_connect(sk, address);
4016
4017 out:
4018         return err;
4019 }
4020
4021 static int selinux_socket_listen(struct socket *sock, int backlog)
4022 {
4023         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4024 }
4025
4026 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4027 {
4028         int err;
4029         struct inode_security_struct *isec;
4030         struct inode_security_struct *newisec;
4031
4032         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4033         if (err)
4034                 return err;
4035
4036         newisec = SOCK_INODE(newsock)->i_security;
4037
4038         isec = SOCK_INODE(sock)->i_security;
4039         newisec->sclass = isec->sclass;
4040         newisec->sid = isec->sid;
4041         newisec->initialized = 1;
4042
4043         return 0;
4044 }
4045
4046 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4047                                   int size)
4048 {
4049         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4050 }
4051
4052 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4053                                   int size, int flags)
4054 {
4055         return sock_has_perm(current, sock->sk, SOCKET__READ);
4056 }
4057
4058 static int selinux_socket_getsockname(struct socket *sock)
4059 {
4060         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4061 }
4062
4063 static int selinux_socket_getpeername(struct socket *sock)
4064 {
4065         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4066 }
4067
4068 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4069 {
4070         int err;
4071
4072         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4073         if (err)
4074                 return err;
4075
4076         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4077 }
4078
4079 static int selinux_socket_getsockopt(struct socket *sock, int level,
4080                                      int optname)
4081 {
4082         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4083 }
4084
4085 static int selinux_socket_shutdown(struct socket *sock, int how)
4086 {
4087         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4088 }
4089
4090 static int selinux_socket_unix_stream_connect(struct sock *sock,
4091                                               struct sock *other,
4092                                               struct sock *newsk)
4093 {
4094         struct sk_security_struct *sksec_sock = sock->sk_security;
4095         struct sk_security_struct *sksec_other = other->sk_security;
4096         struct sk_security_struct *sksec_new = newsk->sk_security;
4097         struct common_audit_data ad;
4098         struct lsm_network_audit net = {0,};
4099         int err;
4100
4101         ad.type = LSM_AUDIT_DATA_NET;
4102         ad.u.net = &net;
4103         ad.u.net->sk = other;
4104
4105         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4106                            sksec_other->sclass,
4107                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4108         if (err)
4109                 return err;
4110
4111         /* server child socket */
4112         sksec_new->peer_sid = sksec_sock->sid;
4113         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4114                                     &sksec_new->sid);
4115         if (err)
4116                 return err;
4117
4118         /* connecting socket */
4119         sksec_sock->peer_sid = sksec_new->sid;
4120
4121         return 0;
4122 }
4123
4124 static int selinux_socket_unix_may_send(struct socket *sock,
4125                                         struct socket *other)
4126 {
4127         struct sk_security_struct *ssec = sock->sk->sk_security;
4128         struct sk_security_struct *osec = other->sk->sk_security;
4129         struct common_audit_data ad;
4130         struct lsm_network_audit net = {0,};
4131
4132         ad.type = LSM_AUDIT_DATA_NET;
4133         ad.u.net = &net;
4134         ad.u.net->sk = other->sk;
4135
4136         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4137                             &ad);
4138 }
4139
4140 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4141                                     u32 peer_sid,
4142                                     struct common_audit_data *ad)
4143 {
4144         int err;
4145         u32 if_sid;
4146         u32 node_sid;
4147
4148         err = sel_netif_sid(ifindex, &if_sid);
4149         if (err)
4150                 return err;
4151         err = avc_has_perm(peer_sid, if_sid,
4152                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4153         if (err)
4154                 return err;
4155
4156         err = sel_netnode_sid(addrp, family, &node_sid);
4157         if (err)
4158                 return err;
4159         return avc_has_perm(peer_sid, node_sid,
4160                             SECCLASS_NODE, NODE__RECVFROM, ad);
4161 }
4162
4163 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4164                                        u16 family)
4165 {
4166         int err = 0;
4167         struct sk_security_struct *sksec = sk->sk_security;
4168         u32 sk_sid = sksec->sid;
4169         struct common_audit_data ad;
4170         struct lsm_network_audit net = {0,};
4171         char *addrp;
4172
4173         ad.type = LSM_AUDIT_DATA_NET;
4174         ad.u.net = &net;
4175         ad.u.net->netif = skb->skb_iif;
4176         ad.u.net->family = family;
4177         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4178         if (err)
4179                 return err;
4180
4181         if (selinux_secmark_enabled()) {
4182                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4183                                    PACKET__RECV, &ad);
4184                 if (err)
4185                         return err;
4186         }
4187
4188         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4189         if (err)
4190                 return err;
4191         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4192
4193         return err;
4194 }
4195
4196 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4197 {
4198         int err;
4199         struct sk_security_struct *sksec = sk->sk_security;
4200         u16 family = sk->sk_family;
4201         u32 sk_sid = sksec->sid;
4202         struct common_audit_data ad;
4203         struct lsm_network_audit net = {0,};
4204         char *addrp;
4205         u8 secmark_active;
4206         u8 peerlbl_active;
4207
4208         if (family != PF_INET && family != PF_INET6)
4209                 return 0;
4210
4211         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4212         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4213                 family = PF_INET;
4214
4215         /* If any sort of compatibility mode is enabled then handoff processing
4216          * to the selinux_sock_rcv_skb_compat() function to deal with the
4217          * special handling.  We do this in an attempt to keep this function
4218          * as fast and as clean as possible. */
4219         if (!selinux_policycap_netpeer)
4220                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4221
4222         secmark_active = selinux_secmark_enabled();
4223         peerlbl_active = selinux_peerlbl_enabled();
4224         if (!secmark_active && !peerlbl_active)
4225                 return 0;
4226
4227         ad.type = LSM_AUDIT_DATA_NET;
4228         ad.u.net = &net;
4229         ad.u.net->netif = skb->skb_iif;
4230         ad.u.net->family = family;
4231         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4232         if (err)
4233                 return err;
4234
4235         if (peerlbl_active) {
4236                 u32 peer_sid;
4237
4238                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4239                 if (err)
4240                         return err;
4241                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4242                                                peer_sid, &ad);
4243                 if (err) {
4244                         selinux_netlbl_err(skb, err, 0);
4245                         return err;
4246                 }
4247                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4248                                    PEER__RECV, &ad);
4249                 if (err)
4250                         selinux_netlbl_err(skb, err, 0);
4251         }
4252
4253         if (secmark_active) {
4254                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4255                                    PACKET__RECV, &ad);
4256                 if (err)
4257                         return err;
4258         }
4259
4260         return err;
4261 }
4262
4263 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4264                                             int __user *optlen, unsigned len)
4265 {
4266         int err = 0;
4267         char *scontext;
4268         u32 scontext_len;
4269         struct sk_security_struct *sksec = sock->sk->sk_security;
4270         u32 peer_sid = SECSID_NULL;
4271
4272         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4273             sksec->sclass == SECCLASS_TCP_SOCKET)
4274                 peer_sid = sksec->peer_sid;
4275         if (peer_sid == SECSID_NULL)
4276                 return -ENOPROTOOPT;
4277
4278         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4279         if (err)
4280                 return err;
4281
4282         if (scontext_len > len) {
4283                 err = -ERANGE;
4284                 goto out_len;
4285         }
4286
4287         if (copy_to_user(optval, scontext, scontext_len))
4288                 err = -EFAULT;
4289
4290 out_len:
4291         if (put_user(scontext_len, optlen))
4292                 err = -EFAULT;
4293         kfree(scontext);
4294         return err;
4295 }
4296
4297 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4298 {
4299         u32 peer_secid = SECSID_NULL;
4300         u16 family;
4301
4302         if (skb && skb->protocol == htons(ETH_P_IP))
4303                 family = PF_INET;
4304         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4305                 family = PF_INET6;
4306         else if (sock)
4307                 family = sock->sk->sk_family;
4308         else
4309                 goto out;
4310
4311         if (sock && family == PF_UNIX)
4312                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4313         else if (skb)
4314                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4315
4316 out:
4317         *secid = peer_secid;
4318         if (peer_secid == SECSID_NULL)
4319                 return -EINVAL;
4320         return 0;
4321 }
4322
4323 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4324 {
4325         struct sk_security_struct *sksec;
4326
4327         sksec = kzalloc(sizeof(*sksec), priority);
4328         if (!sksec)
4329                 return -ENOMEM;
4330
4331         sksec->peer_sid = SECINITSID_UNLABELED;
4332         sksec->sid = SECINITSID_UNLABELED;
4333         selinux_netlbl_sk_security_reset(sksec);
4334         sk->sk_security = sksec;
4335
4336         return 0;
4337 }
4338
4339 static void selinux_sk_free_security(struct sock *sk)
4340 {
4341         struct sk_security_struct *sksec = sk->sk_security;
4342
4343         sk->sk_security = NULL;
4344         selinux_netlbl_sk_security_free(sksec);
4345         kfree(sksec);
4346 }
4347
4348 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4349 {
4350         struct sk_security_struct *sksec = sk->sk_security;
4351         struct sk_security_struct *newsksec = newsk->sk_security;
4352
4353         newsksec->sid = sksec->sid;
4354         newsksec->peer_sid = sksec->peer_sid;
4355         newsksec->sclass = sksec->sclass;
4356
4357         selinux_netlbl_sk_security_reset(newsksec);
4358 }
4359
4360 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4361 {
4362         if (!sk)
4363                 *secid = SECINITSID_ANY_SOCKET;
4364         else {
4365                 struct sk_security_struct *sksec = sk->sk_security;
4366
4367                 *secid = sksec->sid;
4368         }
4369 }
4370
4371 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4372 {
4373         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4374         struct sk_security_struct *sksec = sk->sk_security;
4375
4376         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4377             sk->sk_family == PF_UNIX)
4378                 isec->sid = sksec->sid;
4379         sksec->sclass = isec->sclass;
4380 }
4381
4382 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4383                                      struct request_sock *req)
4384 {
4385         struct sk_security_struct *sksec = sk->sk_security;
4386         int err;
4387         u16 family = sk->sk_family;
4388         u32 newsid;
4389         u32 peersid;
4390
4391         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4392         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4393                 family = PF_INET;
4394
4395         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4396         if (err)
4397                 return err;
4398         if (peersid == SECSID_NULL) {
4399                 req->secid = sksec->sid;
4400                 req->peer_secid = SECSID_NULL;
4401         } else {
4402                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4403                 if (err)
4404                         return err;
4405                 req->secid = newsid;
4406                 req->peer_secid = peersid;
4407         }
4408
4409         return selinux_netlbl_inet_conn_request(req, family);
4410 }
4411
4412 static void selinux_inet_csk_clone(struct sock *newsk,
4413                                    const struct request_sock *req)
4414 {
4415         struct sk_security_struct *newsksec = newsk->sk_security;
4416
4417         newsksec->sid = req->secid;
4418         newsksec->peer_sid = req->peer_secid;
4419         /* NOTE: Ideally, we should also get the isec->sid for the
4420            new socket in sync, but we don't have the isec available yet.
4421            So we will wait until sock_graft to do it, by which
4422            time it will have been created and available. */
4423
4424         /* We don't need to take any sort of lock here as we are the only
4425          * thread with access to newsksec */
4426         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4427 }
4428
4429 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4430 {
4431         u16 family = sk->sk_family;
4432         struct sk_security_struct *sksec = sk->sk_security;
4433
4434         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4435         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4436                 family = PF_INET;
4437
4438         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4439 }
4440
4441 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4442 {
4443         skb_set_owner_w(skb, sk);
4444 }
4445
4446 static int selinux_secmark_relabel_packet(u32 sid)
4447 {
4448         const struct task_security_struct *__tsec;
4449         u32 tsid;
4450
4451         __tsec = current_security();
4452         tsid = __tsec->sid;
4453
4454         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4455 }
4456
4457 static void selinux_secmark_refcount_inc(void)
4458 {
4459         atomic_inc(&selinux_secmark_refcount);
4460 }
4461
4462 static void selinux_secmark_refcount_dec(void)
4463 {
4464         atomic_dec(&selinux_secmark_refcount);
4465 }
4466
4467 static void selinux_req_classify_flow(const struct request_sock *req,
4468                                       struct flowi *fl)
4469 {
4470         fl->flowi_secid = req->secid;
4471 }
4472
4473 static int selinux_tun_dev_alloc_security(void **security)
4474 {
4475         struct tun_security_struct *tunsec;
4476
4477         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4478         if (!tunsec)
4479                 return -ENOMEM;
4480         tunsec->sid = current_sid();
4481
4482         *security = tunsec;
4483         return 0;
4484 }
4485
4486 static void selinux_tun_dev_free_security(void *security)
4487 {
4488         kfree(security);
4489 }
4490
4491 static int selinux_tun_dev_create(void)
4492 {
4493         u32 sid = current_sid();
4494
4495         /* we aren't taking into account the "sockcreate" SID since the socket
4496          * that is being created here is not a socket in the traditional sense,
4497          * instead it is a private sock, accessible only to the kernel, and
4498          * representing a wide range of network traffic spanning multiple
4499          * connections unlike traditional sockets - check the TUN driver to
4500          * get a better understanding of why this socket is special */
4501
4502         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4503                             NULL);
4504 }
4505
4506 static int selinux_tun_dev_attach_queue(void *security)
4507 {
4508         struct tun_security_struct *tunsec = security;
4509
4510         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4511                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4512 }
4513
4514 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4515 {
4516         struct tun_security_struct *tunsec = security;
4517         struct sk_security_struct *sksec = sk->sk_security;
4518
4519         /* we don't currently perform any NetLabel based labeling here and it
4520          * isn't clear that we would want to do so anyway; while we could apply
4521          * labeling without the support of the TUN user the resulting labeled
4522          * traffic from the other end of the connection would almost certainly
4523          * cause confusion to the TUN user that had no idea network labeling
4524          * protocols were being used */
4525
4526         sksec->sid = tunsec->sid;
4527         sksec->sclass = SECCLASS_TUN_SOCKET;
4528
4529         return 0;
4530 }
4531
4532 static int selinux_tun_dev_open(void *security)
4533 {
4534         struct tun_security_struct *tunsec = security;
4535         u32 sid = current_sid();
4536         int err;
4537
4538         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4539                            TUN_SOCKET__RELABELFROM, NULL);
4540         if (err)
4541                 return err;
4542         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4543                            TUN_SOCKET__RELABELTO, NULL);
4544         if (err)
4545                 return err;
4546         tunsec->sid = sid;
4547
4548         return 0;
4549 }
4550
4551 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4552 {
4553         int err = 0;
4554         u32 perm;
4555         struct nlmsghdr *nlh;
4556         struct sk_security_struct *sksec = sk->sk_security;
4557
4558         if (skb->len < NLMSG_HDRLEN) {
4559                 err = -EINVAL;
4560                 goto out;
4561         }
4562         nlh = nlmsg_hdr(skb);
4563
4564         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4565         if (err) {
4566                 if (err == -EINVAL) {
4567                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4568                                   "SELinux:  unrecognized netlink message"
4569                                   " type=%hu for sclass=%hu\n",
4570                                   nlh->nlmsg_type, sksec->sclass);
4571                         if (!selinux_enforcing || security_get_allow_unknown())
4572                                 err = 0;
4573                 }
4574
4575                 /* Ignore */
4576                 if (err == -ENOENT)
4577                         err = 0;
4578                 goto out;
4579         }
4580
4581         err = sock_has_perm(current, sk, perm);
4582 out:
4583         return err;
4584 }
4585
4586 #ifdef CONFIG_NETFILTER
4587
4588 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4589                                        u16 family)
4590 {
4591         int err;
4592         char *addrp;
4593         u32 peer_sid;
4594         struct common_audit_data ad;
4595         struct lsm_network_audit net = {0,};
4596         u8 secmark_active;
4597         u8 netlbl_active;
4598         u8 peerlbl_active;
4599
4600         if (!selinux_policycap_netpeer)
4601                 return NF_ACCEPT;
4602
4603         secmark_active = selinux_secmark_enabled();
4604         netlbl_active = netlbl_enabled();
4605         peerlbl_active = selinux_peerlbl_enabled();
4606         if (!secmark_active && !peerlbl_active)
4607                 return NF_ACCEPT;
4608
4609         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4610                 return NF_DROP;
4611
4612         ad.type = LSM_AUDIT_DATA_NET;
4613         ad.u.net = &net;
4614         ad.u.net->netif = ifindex;
4615         ad.u.net->family = family;
4616         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4617                 return NF_DROP;
4618
4619         if (peerlbl_active) {
4620                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4621                                                peer_sid, &ad);
4622                 if (err) {
4623                         selinux_netlbl_err(skb, err, 1);
4624                         return NF_DROP;
4625                 }
4626         }
4627
4628         if (secmark_active)
4629                 if (avc_has_perm(peer_sid, skb->secmark,
4630                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4631                         return NF_DROP;
4632
4633         if (netlbl_active)
4634                 /* we do this in the FORWARD path and not the POST_ROUTING
4635                  * path because we want to make sure we apply the necessary
4636                  * labeling before IPsec is applied so we can leverage AH
4637                  * protection */
4638                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4639                         return NF_DROP;
4640
4641         return NF_ACCEPT;
4642 }
4643
4644 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4645                                          struct sk_buff *skb,
4646                                          const struct net_device *in,
4647                                          const struct net_device *out,
4648                                          int (*okfn)(struct sk_buff *))
4649 {
4650         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4651 }
4652
4653 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4654 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4655                                          struct sk_buff *skb,
4656                                          const struct net_device *in,
4657                                          const struct net_device *out,
4658                                          int (*okfn)(struct sk_buff *))
4659 {
4660         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4661 }
4662 #endif  /* IPV6 */
4663
4664 static unsigned int selinux_ip_output(struct sk_buff *skb,
4665                                       u16 family)
4666 {
4667         u32 sid;
4668
4669         if (!netlbl_enabled())
4670                 return NF_ACCEPT;
4671
4672         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4673          * because we want to make sure we apply the necessary labeling
4674          * before IPsec is applied so we can leverage AH protection */
4675         if (skb->sk) {
4676                 struct sk_security_struct *sksec = skb->sk->sk_security;
4677                 sid = sksec->sid;
4678         } else
4679                 sid = SECINITSID_KERNEL;
4680         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4681                 return NF_DROP;
4682
4683         return NF_ACCEPT;
4684 }
4685
4686 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4687                                         struct sk_buff *skb,
4688                                         const struct net_device *in,
4689                                         const struct net_device *out,
4690                                         int (*okfn)(struct sk_buff *))
4691 {
4692         return selinux_ip_output(skb, PF_INET);
4693 }
4694
4695 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4696                                                 int ifindex,
4697                                                 u16 family)
4698 {
4699         struct sock *sk = skb->sk;
4700         struct sk_security_struct *sksec;
4701         struct common_audit_data ad;
4702         struct lsm_network_audit net = {0,};
4703         char *addrp;
4704         u8 proto;
4705
4706         if (sk == NULL)
4707                 return NF_ACCEPT;
4708         sksec = sk->sk_security;
4709
4710         ad.type = LSM_AUDIT_DATA_NET;
4711         ad.u.net = &net;
4712         ad.u.net->netif = ifindex;
4713         ad.u.net->family = family;
4714         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4715                 return NF_DROP;
4716
4717         if (selinux_secmark_enabled())
4718                 if (avc_has_perm(sksec->sid, skb->secmark,
4719                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4720                         return NF_DROP_ERR(-ECONNREFUSED);
4721
4722         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4723                 return NF_DROP_ERR(-ECONNREFUSED);
4724
4725         return NF_ACCEPT;
4726 }
4727
4728 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4729                                          u16 family)
4730 {
4731         u32 secmark_perm;
4732         u32 peer_sid;
4733         struct sock *sk;
4734         struct common_audit_data ad;
4735         struct lsm_network_audit net = {0,};
4736         char *addrp;
4737         u8 secmark_active;
4738         u8 peerlbl_active;
4739
4740         /* If any sort of compatibility mode is enabled then handoff processing
4741          * to the selinux_ip_postroute_compat() function to deal with the
4742          * special handling.  We do this in an attempt to keep this function
4743          * as fast and as clean as possible. */
4744         if (!selinux_policycap_netpeer)
4745                 return selinux_ip_postroute_compat(skb, ifindex, family);
4746 #ifdef CONFIG_XFRM
4747         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4748          * packet transformation so allow the packet to pass without any checks
4749          * since we'll have another chance to perform access control checks
4750          * when the packet is on it's final way out.
4751          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4752          *       is NULL, in this case go ahead and apply access control. */
4753         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4754                 return NF_ACCEPT;
4755 #endif
4756         secmark_active = selinux_secmark_enabled();
4757         peerlbl_active = selinux_peerlbl_enabled();
4758         if (!secmark_active && !peerlbl_active)
4759                 return NF_ACCEPT;
4760
4761         /* if the packet is being forwarded then get the peer label from the
4762          * packet itself; otherwise check to see if it is from a local
4763          * application or the kernel, if from an application get the peer label
4764          * from the sending socket, otherwise use the kernel's sid */
4765         sk = skb->sk;
4766         if (sk == NULL) {
4767                 if (skb->skb_iif) {
4768                         secmark_perm = PACKET__FORWARD_OUT;
4769                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4770                                 return NF_DROP;
4771                 } else {
4772                         secmark_perm = PACKET__SEND;
4773                         peer_sid = SECINITSID_KERNEL;
4774                 }
4775         } else {
4776                 struct sk_security_struct *sksec = sk->sk_security;
4777                 peer_sid = sksec->sid;
4778                 secmark_perm = PACKET__SEND;
4779         }
4780
4781         ad.type = LSM_AUDIT_DATA_NET;
4782         ad.u.net = &net;
4783         ad.u.net->netif = ifindex;
4784         ad.u.net->family = family;
4785         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4786                 return NF_DROP;
4787
4788         if (secmark_active)
4789                 if (avc_has_perm(peer_sid, skb->secmark,
4790                                  SECCLASS_PACKET, secmark_perm, &ad))
4791                         return NF_DROP_ERR(-ECONNREFUSED);
4792
4793         if (peerlbl_active) {
4794                 u32 if_sid;
4795                 u32 node_sid;
4796
4797                 if (sel_netif_sid(ifindex, &if_sid))
4798                         return NF_DROP;
4799                 if (avc_has_perm(peer_sid, if_sid,
4800                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4801                         return NF_DROP_ERR(-ECONNREFUSED);
4802
4803                 if (sel_netnode_sid(addrp, family, &node_sid))
4804                         return NF_DROP;
4805                 if (avc_has_perm(peer_sid, node_sid,
4806                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4807                         return NF_DROP_ERR(-ECONNREFUSED);
4808         }
4809
4810         return NF_ACCEPT;
4811 }
4812
4813 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4814                                            struct sk_buff *skb,
4815                                            const struct net_device *in,
4816                                            const struct net_device *out,
4817                                            int (*okfn)(struct sk_buff *))
4818 {
4819         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4820 }
4821
4822 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4823 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4824                                            struct sk_buff *skb,
4825                                            const struct net_device *in,
4826                                            const struct net_device *out,
4827                                            int (*okfn)(struct sk_buff *))
4828 {
4829         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4830 }
4831 #endif  /* IPV6 */
4832
4833 #endif  /* CONFIG_NETFILTER */
4834
4835 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4836 {
4837         int err;
4838
4839         err = cap_netlink_send(sk, skb);
4840         if (err)
4841                 return err;
4842
4843         return selinux_nlmsg_perm(sk, skb);
4844 }
4845
4846 static int ipc_alloc_security(struct task_struct *task,
4847                               struct kern_ipc_perm *perm,
4848                               u16 sclass)
4849 {
4850         struct ipc_security_struct *isec;
4851         u32 sid;
4852
4853         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4854         if (!isec)
4855                 return -ENOMEM;
4856
4857         sid = task_sid(task);
4858         isec->sclass = sclass;
4859         isec->sid = sid;
4860         perm->security = isec;
4861
4862         return 0;
4863 }
4864
4865 static void ipc_free_security(struct kern_ipc_perm *perm)
4866 {
4867         struct ipc_security_struct *isec = perm->security;
4868         perm->security = NULL;
4869         kfree(isec);
4870 }
4871
4872 static int msg_msg_alloc_security(struct msg_msg *msg)
4873 {
4874         struct msg_security_struct *msec;
4875
4876         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4877         if (!msec)
4878                 return -ENOMEM;
4879
4880         msec->sid = SECINITSID_UNLABELED;
4881         msg->security = msec;
4882
4883         return 0;
4884 }
4885
4886 static void msg_msg_free_security(struct msg_msg *msg)
4887 {
4888         struct msg_security_struct *msec = msg->security;
4889
4890         msg->security = NULL;
4891         kfree(msec);
4892 }
4893
4894 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4895                         u32 perms)
4896 {
4897         struct ipc_security_struct *isec;
4898         struct common_audit_data ad;
4899         u32 sid = current_sid();
4900
4901         isec = ipc_perms->security;
4902
4903         ad.type = LSM_AUDIT_DATA_IPC;
4904         ad.u.ipc_id = ipc_perms->key;
4905
4906         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4907 }
4908
4909 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4910 {
4911         return msg_msg_alloc_security(msg);
4912 }
4913
4914 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4915 {
4916         msg_msg_free_security(msg);
4917 }
4918
4919 /* message queue security operations */
4920 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4921 {
4922         struct ipc_security_struct *isec;
4923         struct common_audit_data ad;
4924         u32 sid = current_sid();
4925         int rc;
4926
4927         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4928         if (rc)
4929                 return rc;
4930
4931         isec = msq->q_perm.security;
4932
4933         ad.type = LSM_AUDIT_DATA_IPC;
4934         ad.u.ipc_id = msq->q_perm.key;
4935
4936         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4937                           MSGQ__CREATE, &ad);
4938         if (rc) {
4939                 ipc_free_security(&msq->q_perm);
4940                 return rc;
4941         }
4942         return 0;
4943 }
4944
4945 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4946 {
4947         ipc_free_security(&msq->q_perm);
4948 }
4949
4950 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4951 {
4952         struct ipc_security_struct *isec;
4953         struct common_audit_data ad;
4954         u32 sid = current_sid();
4955
4956         isec = msq->q_perm.security;
4957
4958         ad.type = LSM_AUDIT_DATA_IPC;
4959         ad.u.ipc_id = msq->q_perm.key;
4960
4961         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4962                             MSGQ__ASSOCIATE, &ad);
4963 }
4964
4965 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4966 {
4967         int err;
4968         int perms;
4969
4970         switch (cmd) {
4971         case IPC_INFO:
4972         case MSG_INFO:
4973                 /* No specific object, just general system-wide information. */
4974                 return task_has_system(current, SYSTEM__IPC_INFO);
4975         case IPC_STAT:
4976         case MSG_STAT:
4977                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4978                 break;
4979         case IPC_SET:
4980                 perms = MSGQ__SETATTR;
4981                 break;
4982         case IPC_RMID:
4983                 perms = MSGQ__DESTROY;
4984                 break;
4985         default:
4986                 return 0;
4987         }
4988
4989         err = ipc_has_perm(&msq->q_perm, perms);
4990         return err;
4991 }
4992
4993 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4994 {
4995         struct ipc_security_struct *isec;
4996         struct msg_security_struct *msec;
4997         struct common_audit_data ad;
4998         u32 sid = current_sid();
4999         int rc;
5000
5001         isec = msq->q_perm.security;
5002         msec = msg->security;
5003
5004         /*
5005          * First time through, need to assign label to the message
5006          */
5007         if (msec->sid == SECINITSID_UNLABELED) {
5008                 /*
5009                  * Compute new sid based on current process and
5010                  * message queue this message will be stored in
5011                  */
5012                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5013                                              NULL, &msec->sid);
5014                 if (rc)
5015                         return rc;
5016         }
5017
5018         ad.type = LSM_AUDIT_DATA_IPC;
5019         ad.u.ipc_id = msq->q_perm.key;
5020
5021         /* Can this process write to the queue? */
5022         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5023                           MSGQ__WRITE, &ad);
5024         if (!rc)
5025                 /* Can this process send the message */
5026                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5027                                   MSG__SEND, &ad);
5028         if (!rc)
5029                 /* Can the message be put in the queue? */
5030                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5031                                   MSGQ__ENQUEUE, &ad);
5032
5033         return rc;
5034 }
5035
5036 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5037                                     struct task_struct *target,
5038                                     long type, int mode)
5039 {
5040         struct ipc_security_struct *isec;
5041         struct msg_security_struct *msec;
5042         struct common_audit_data ad;
5043         u32 sid = task_sid(target);
5044         int rc;
5045
5046         isec = msq->q_perm.security;
5047         msec = msg->security;
5048
5049         ad.type = LSM_AUDIT_DATA_IPC;
5050         ad.u.ipc_id = msq->q_perm.key;
5051
5052         rc = avc_has_perm(sid, isec->sid,
5053                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5054         if (!rc)
5055                 rc = avc_has_perm(sid, msec->sid,
5056                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5057         return rc;
5058 }
5059
5060 /* Shared Memory security operations */
5061 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5062 {
5063         struct ipc_security_struct *isec;
5064         struct common_audit_data ad;
5065         u32 sid = current_sid();
5066         int rc;
5067
5068         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5069         if (rc)
5070                 return rc;
5071
5072         isec = shp->shm_perm.security;
5073
5074         ad.type = LSM_AUDIT_DATA_IPC;
5075         ad.u.ipc_id = shp->shm_perm.key;
5076
5077         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5078                           SHM__CREATE, &ad);
5079         if (rc) {
5080                 ipc_free_security(&shp->shm_perm);
5081                 return rc;
5082         }
5083         return 0;
5084 }
5085
5086 static void selinux_shm_free_security(struct shmid_kernel *shp)
5087 {
5088         ipc_free_security(&shp->shm_perm);
5089 }
5090
5091 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5092 {
5093         struct ipc_security_struct *isec;
5094         struct common_audit_data ad;
5095         u32 sid = current_sid();
5096
5097         isec = shp->shm_perm.security;
5098
5099         ad.type = LSM_AUDIT_DATA_IPC;
5100         ad.u.ipc_id = shp->shm_perm.key;
5101
5102         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5103                             SHM__ASSOCIATE, &ad);
5104 }
5105
5106 /* Note, at this point, shp is locked down */
5107 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5108 {
5109         int perms;
5110         int err;
5111
5112         switch (cmd) {
5113         case IPC_INFO:
5114         case SHM_INFO:
5115                 /* No specific object, just general system-wide information. */
5116                 return task_has_system(current, SYSTEM__IPC_INFO);
5117         case IPC_STAT:
5118         case SHM_STAT:
5119                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5120                 break;
5121         case IPC_SET:
5122                 perms = SHM__SETATTR;
5123                 break;
5124         case SHM_LOCK:
5125         case SHM_UNLOCK:
5126                 perms = SHM__LOCK;
5127                 break;
5128         case IPC_RMID:
5129                 perms = SHM__DESTROY;
5130                 break;
5131         default:
5132                 return 0;
5133         }
5134
5135         err = ipc_has_perm(&shp->shm_perm, perms);
5136         return err;
5137 }
5138
5139 static int selinux_shm_shmat(struct shmid_kernel *shp,
5140                              char __user *shmaddr, int shmflg)
5141 {
5142         u32 perms;
5143
5144         if (shmflg & SHM_RDONLY)
5145                 perms = SHM__READ;
5146         else
5147                 perms = SHM__READ | SHM__WRITE;
5148
5149         return ipc_has_perm(&shp->shm_perm, perms);
5150 }
5151
5152 /* Semaphore security operations */
5153 static int selinux_sem_alloc_security(struct sem_array *sma)
5154 {
5155         struct ipc_security_struct *isec;
5156         struct common_audit_data ad;
5157         u32 sid = current_sid();
5158         int rc;
5159
5160         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5161         if (rc)
5162                 return rc;
5163
5164         isec = sma->sem_perm.security;
5165
5166         ad.type = LSM_AUDIT_DATA_IPC;
5167         ad.u.ipc_id = sma->sem_perm.key;
5168
5169         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5170                           SEM__CREATE, &ad);
5171         if (rc) {
5172                 ipc_free_security(&sma->sem_perm);
5173                 return rc;
5174         }
5175         return 0;
5176 }
5177
5178 static void selinux_sem_free_security(struct sem_array *sma)
5179 {
5180         ipc_free_security(&sma->sem_perm);
5181 }
5182
5183 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5184 {
5185         struct ipc_security_struct *isec;
5186         struct common_audit_data ad;
5187         u32 sid = current_sid();
5188
5189         isec = sma->sem_perm.security;
5190
5191         ad.type = LSM_AUDIT_DATA_IPC;
5192         ad.u.ipc_id = sma->sem_perm.key;
5193
5194         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5195                             SEM__ASSOCIATE, &ad);
5196 }
5197
5198 /* Note, at this point, sma is locked down */
5199 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5200 {
5201         int err;
5202         u32 perms;
5203
5204         switch (cmd) {
5205         case IPC_INFO:
5206         case SEM_INFO:
5207                 /* No specific object, just general system-wide information. */
5208                 return task_has_system(current, SYSTEM__IPC_INFO);
5209         case GETPID:
5210         case GETNCNT:
5211         case GETZCNT:
5212                 perms = SEM__GETATTR;
5213                 break;
5214         case GETVAL:
5215         case GETALL:
5216                 perms = SEM__READ;
5217                 break;
5218         case SETVAL:
5219         case SETALL:
5220                 perms = SEM__WRITE;
5221                 break;
5222         case IPC_RMID:
5223                 perms = SEM__DESTROY;
5224                 break;
5225         case IPC_SET:
5226                 perms = SEM__SETATTR;
5227                 break;
5228         case IPC_STAT:
5229         case SEM_STAT:
5230                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5231                 break;
5232         default:
5233                 return 0;
5234         }
5235
5236         err = ipc_has_perm(&sma->sem_perm, perms);
5237         return err;
5238 }
5239
5240 static int selinux_sem_semop(struct sem_array *sma,
5241                              struct sembuf *sops, unsigned nsops, int alter)
5242 {
5243         u32 perms;
5244
5245         if (alter)
5246                 perms = SEM__READ | SEM__WRITE;
5247         else
5248                 perms = SEM__READ;
5249
5250         return ipc_has_perm(&sma->sem_perm, perms);
5251 }
5252
5253 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5254 {
5255         u32 av = 0;
5256
5257         av = 0;
5258         if (flag & S_IRUGO)
5259                 av |= IPC__UNIX_READ;
5260         if (flag & S_IWUGO)
5261                 av |= IPC__UNIX_WRITE;
5262
5263         if (av == 0)
5264                 return 0;
5265
5266         return ipc_has_perm(ipcp, av);
5267 }
5268
5269 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5270 {
5271         struct ipc_security_struct *isec = ipcp->security;
5272         *secid = isec->sid;
5273 }
5274
5275 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5276 {
5277         if (inode)
5278                 inode_doinit_with_dentry(inode, dentry);
5279 }
5280
5281 static int selinux_getprocattr(struct task_struct *p,
5282                                char *name, char **value)
5283 {
5284         const struct task_security_struct *__tsec;
5285         u32 sid;
5286         int error;
5287         unsigned len;
5288
5289         if (current != p) {
5290                 error = current_has_perm(p, PROCESS__GETATTR);
5291                 if (error)
5292                         return error;
5293         }
5294
5295         rcu_read_lock();
5296         __tsec = __task_cred(p)->security;
5297
5298         if (!strcmp(name, "current"))
5299                 sid = __tsec->sid;
5300         else if (!strcmp(name, "prev"))
5301                 sid = __tsec->osid;
5302         else if (!strcmp(name, "exec"))
5303                 sid = __tsec->exec_sid;
5304         else if (!strcmp(name, "fscreate"))
5305                 sid = __tsec->create_sid;
5306         else if (!strcmp(name, "keycreate"))
5307                 sid = __tsec->keycreate_sid;
5308         else if (!strcmp(name, "sockcreate"))
5309                 sid = __tsec->sockcreate_sid;
5310         else
5311                 goto invalid;
5312         rcu_read_unlock();
5313
5314         if (!sid)
5315                 return 0;
5316
5317         error = security_sid_to_context(sid, value, &len);
5318         if (error)
5319                 return error;
5320         return len;
5321
5322 invalid:
5323         rcu_read_unlock();
5324         return -EINVAL;
5325 }
5326
5327 static int selinux_setprocattr(struct task_struct *p,
5328                                char *name, void *value, size_t size)
5329 {
5330         struct task_security_struct *tsec;
5331         struct task_struct *tracer;
5332         struct cred *new;
5333         u32 sid = 0, ptsid;
5334         int error;
5335         char *str = value;
5336
5337         if (current != p) {
5338                 /* SELinux only allows a process to change its own
5339                    security attributes. */
5340                 return -EACCES;
5341         }
5342
5343         /*
5344          * Basic control over ability to set these attributes at all.
5345          * current == p, but we'll pass them separately in case the
5346          * above restriction is ever removed.
5347          */
5348         if (!strcmp(name, "exec"))
5349                 error = current_has_perm(p, PROCESS__SETEXEC);
5350         else if (!strcmp(name, "fscreate"))
5351                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5352         else if (!strcmp(name, "keycreate"))
5353                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5354         else if (!strcmp(name, "sockcreate"))
5355                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5356         else if (!strcmp(name, "current"))
5357                 error = current_has_perm(p, PROCESS__SETCURRENT);
5358         else
5359                 error = -EINVAL;
5360         if (error)
5361                 return error;
5362
5363         /* Obtain a SID for the context, if one was specified. */
5364         if (size && str[1] && str[1] != '\n') {
5365                 if (str[size-1] == '\n') {
5366                         str[size-1] = 0;
5367                         size--;
5368                 }
5369                 error = security_context_to_sid(value, size, &sid);
5370                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5371                         if (!capable(CAP_MAC_ADMIN)) {
5372                                 struct audit_buffer *ab;
5373                                 size_t audit_size;
5374
5375                                 /* We strip a nul only if it is at the end, otherwise the
5376                                  * context contains a nul and we should audit that */
5377                                 if (str[size - 1] == '\0')
5378                                         audit_size = size - 1;
5379                                 else
5380                                         audit_size = size;
5381                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5382                                 audit_log_format(ab, "op=fscreate invalid_context=");
5383                                 audit_log_n_untrustedstring(ab, value, audit_size);
5384                                 audit_log_end(ab);
5385
5386                                 return error;
5387                         }
5388                         error = security_context_to_sid_force(value, size,
5389                                                               &sid);
5390                 }
5391                 if (error)
5392                         return error;
5393         }
5394
5395         new = prepare_creds();
5396         if (!new)
5397                 return -ENOMEM;
5398
5399         /* Permission checking based on the specified context is
5400            performed during the actual operation (execve,
5401            open/mkdir/...), when we know the full context of the
5402            operation.  See selinux_bprm_set_creds for the execve
5403            checks and may_create for the file creation checks. The
5404            operation will then fail if the context is not permitted. */
5405         tsec = new->security;
5406         if (!strcmp(name, "exec")) {
5407                 tsec->exec_sid = sid;
5408         } else if (!strcmp(name, "fscreate")) {
5409                 tsec->create_sid = sid;
5410         } else if (!strcmp(name, "keycreate")) {
5411                 error = may_create_key(sid, p);
5412                 if (error)
5413                         goto abort_change;
5414                 tsec->keycreate_sid = sid;
5415         } else if (!strcmp(name, "sockcreate")) {
5416                 tsec->sockcreate_sid = sid;
5417         } else if (!strcmp(name, "current")) {
5418                 error = -EINVAL;
5419                 if (sid == 0)
5420                         goto abort_change;
5421
5422                 /* Only allow single threaded processes to change context */
5423                 error = -EPERM;
5424                 if (!current_is_single_threaded()) {
5425                         error = security_bounded_transition(tsec->sid, sid);
5426                         if (error)
5427                                 goto abort_change;
5428                 }
5429
5430                 /* Check permissions for the transition. */
5431                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5432                                      PROCESS__DYNTRANSITION, NULL);
5433                 if (error)
5434                         goto abort_change;
5435
5436                 /* Check for ptracing, and update the task SID if ok.
5437                    Otherwise, leave SID unchanged and fail. */
5438                 ptsid = 0;
5439                 task_lock(p);
5440                 tracer = ptrace_parent(p);
5441                 if (tracer)
5442                         ptsid = task_sid(tracer);
5443                 task_unlock(p);
5444
5445                 if (tracer) {
5446                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5447                                              PROCESS__PTRACE, NULL);
5448                         if (error)
5449                                 goto abort_change;
5450                 }
5451
5452                 tsec->sid = sid;
5453         } else {
5454                 error = -EINVAL;
5455                 goto abort_change;
5456         }
5457
5458         commit_creds(new);
5459         return size;
5460
5461 abort_change:
5462         abort_creds(new);
5463         return error;
5464 }
5465
5466 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5467 {
5468         return security_sid_to_context(secid, secdata, seclen);
5469 }
5470
5471 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5472 {
5473         return security_context_to_sid(secdata, seclen, secid);
5474 }
5475
5476 static void selinux_release_secctx(char *secdata, u32 seclen)
5477 {
5478         kfree(secdata);
5479 }
5480
5481 /*
5482  *      called with inode->i_mutex locked
5483  */
5484 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5485 {
5486         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5487 }
5488
5489 /*
5490  *      called with inode->i_mutex locked
5491  */
5492 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5493 {
5494         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5495 }
5496
5497 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5498 {
5499         int len = 0;
5500         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5501                                                 ctx, true);
5502         if (len < 0)
5503                 return len;
5504         *ctxlen = len;
5505         return 0;
5506 }
5507 #ifdef CONFIG_KEYS
5508
5509 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5510                              unsigned long flags)
5511 {
5512         const struct task_security_struct *tsec;
5513         struct key_security_struct *ksec;
5514
5515         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5516         if (!ksec)
5517                 return -ENOMEM;
5518
5519         tsec = cred->security;
5520         if (tsec->keycreate_sid)
5521                 ksec->sid = tsec->keycreate_sid;
5522         else
5523                 ksec->sid = tsec->sid;
5524
5525         k->security = ksec;
5526         return 0;
5527 }
5528
5529 static void selinux_key_free(struct key *k)
5530 {
5531         struct key_security_struct *ksec = k->security;
5532
5533         k->security = NULL;
5534         kfree(ksec);
5535 }
5536
5537 static int selinux_key_permission(key_ref_t key_ref,
5538                                   const struct cred *cred,
5539                                   key_perm_t perm)
5540 {
5541         struct key *key;
5542         struct key_security_struct *ksec;
5543         u32 sid;
5544
5545         /* if no specific permissions are requested, we skip the
5546            permission check. No serious, additional covert channels
5547            appear to be created. */
5548         if (perm == 0)
5549                 return 0;
5550
5551         sid = cred_sid(cred);
5552
5553         key = key_ref_to_ptr(key_ref);
5554         ksec = key->security;
5555
5556         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5557 }
5558
5559 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5560 {
5561         struct key_security_struct *ksec = key->security;
5562         char *context = NULL;
5563         unsigned len;
5564         int rc;
5565
5566         rc = security_sid_to_context(ksec->sid, &context, &len);
5567         if (!rc)
5568                 rc = len;
5569         *_buffer = context;
5570         return rc;
5571 }
5572
5573 #endif
5574
5575 static struct security_operations selinux_ops = {
5576         .name =                         "selinux",
5577
5578         .ptrace_access_check =          selinux_ptrace_access_check,
5579         .ptrace_traceme =               selinux_ptrace_traceme,
5580         .capget =                       selinux_capget,
5581         .capset =                       selinux_capset,
5582         .capable =                      selinux_capable,
5583         .quotactl =                     selinux_quotactl,
5584         .quota_on =                     selinux_quota_on,
5585         .syslog =                       selinux_syslog,
5586         .vm_enough_memory =             selinux_vm_enough_memory,
5587
5588         .netlink_send =                 selinux_netlink_send,
5589
5590         .bprm_set_creds =               selinux_bprm_set_creds,
5591         .bprm_committing_creds =        selinux_bprm_committing_creds,
5592         .bprm_committed_creds =         selinux_bprm_committed_creds,
5593         .bprm_secureexec =              selinux_bprm_secureexec,
5594
5595         .sb_alloc_security =            selinux_sb_alloc_security,
5596         .sb_free_security =             selinux_sb_free_security,
5597         .sb_copy_data =                 selinux_sb_copy_data,
5598         .sb_remount =                   selinux_sb_remount,
5599         .sb_kern_mount =                selinux_sb_kern_mount,
5600         .sb_show_options =              selinux_sb_show_options,
5601         .sb_statfs =                    selinux_sb_statfs,
5602         .sb_mount =                     selinux_mount,
5603         .sb_umount =                    selinux_umount,
5604         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5605         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5606         .sb_parse_opts_str =            selinux_parse_opts_str,
5607
5608
5609         .inode_alloc_security =         selinux_inode_alloc_security,
5610         .inode_free_security =          selinux_inode_free_security,
5611         .inode_init_security =          selinux_inode_init_security,
5612         .inode_create =                 selinux_inode_create,
5613         .inode_link =                   selinux_inode_link,
5614         .inode_unlink =                 selinux_inode_unlink,
5615         .inode_symlink =                selinux_inode_symlink,
5616         .inode_mkdir =                  selinux_inode_mkdir,
5617         .inode_rmdir =                  selinux_inode_rmdir,
5618         .inode_mknod =                  selinux_inode_mknod,
5619         .inode_rename =                 selinux_inode_rename,
5620         .inode_readlink =               selinux_inode_readlink,
5621         .inode_follow_link =            selinux_inode_follow_link,
5622         .inode_permission =             selinux_inode_permission,
5623         .inode_setattr =                selinux_inode_setattr,
5624         .inode_getattr =                selinux_inode_getattr,
5625         .inode_setxattr =               selinux_inode_setxattr,
5626         .inode_post_setxattr =          selinux_inode_post_setxattr,
5627         .inode_getxattr =               selinux_inode_getxattr,
5628         .inode_listxattr =              selinux_inode_listxattr,
5629         .inode_removexattr =            selinux_inode_removexattr,
5630         .inode_getsecurity =            selinux_inode_getsecurity,
5631         .inode_setsecurity =            selinux_inode_setsecurity,
5632         .inode_listsecurity =           selinux_inode_listsecurity,
5633         .inode_getsecid =               selinux_inode_getsecid,
5634
5635         .file_permission =              selinux_file_permission,
5636         .file_alloc_security =          selinux_file_alloc_security,
5637         .file_free_security =           selinux_file_free_security,
5638         .file_ioctl =                   selinux_file_ioctl,
5639         .mmap_file =                    selinux_mmap_file,
5640         .mmap_addr =                    selinux_mmap_addr,
5641         .file_mprotect =                selinux_file_mprotect,
5642         .file_lock =                    selinux_file_lock,
5643         .file_fcntl =                   selinux_file_fcntl,
5644         .file_set_fowner =              selinux_file_set_fowner,
5645         .file_send_sigiotask =          selinux_file_send_sigiotask,
5646         .file_receive =                 selinux_file_receive,
5647
5648         .file_open =                    selinux_file_open,
5649
5650         .task_create =                  selinux_task_create,
5651         .cred_alloc_blank =             selinux_cred_alloc_blank,
5652         .cred_free =                    selinux_cred_free,
5653         .cred_prepare =                 selinux_cred_prepare,
5654         .cred_transfer =                selinux_cred_transfer,
5655         .kernel_act_as =                selinux_kernel_act_as,
5656         .kernel_create_files_as =       selinux_kernel_create_files_as,
5657         .kernel_module_request =        selinux_kernel_module_request,
5658         .task_setpgid =                 selinux_task_setpgid,
5659         .task_getpgid =                 selinux_task_getpgid,
5660         .task_getsid =                  selinux_task_getsid,
5661         .task_getsecid =                selinux_task_getsecid,
5662         .task_setnice =                 selinux_task_setnice,
5663         .task_setioprio =               selinux_task_setioprio,
5664         .task_getioprio =               selinux_task_getioprio,
5665         .task_setrlimit =               selinux_task_setrlimit,
5666         .task_setscheduler =            selinux_task_setscheduler,
5667         .task_getscheduler =            selinux_task_getscheduler,
5668         .task_movememory =              selinux_task_movememory,
5669         .task_kill =                    selinux_task_kill,
5670         .task_wait =                    selinux_task_wait,
5671         .task_to_inode =                selinux_task_to_inode,
5672
5673         .ipc_permission =               selinux_ipc_permission,
5674         .ipc_getsecid =                 selinux_ipc_getsecid,
5675
5676         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5677         .msg_msg_free_security =        selinux_msg_msg_free_security,
5678
5679         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5680         .msg_queue_free_security =      selinux_msg_queue_free_security,
5681         .msg_queue_associate =          selinux_msg_queue_associate,
5682         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5683         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5684         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5685
5686         .shm_alloc_security =           selinux_shm_alloc_security,
5687         .shm_free_security =            selinux_shm_free_security,
5688         .shm_associate =                selinux_shm_associate,
5689         .shm_shmctl =                   selinux_shm_shmctl,
5690         .shm_shmat =                    selinux_shm_shmat,
5691
5692         .sem_alloc_security =           selinux_sem_alloc_security,
5693         .sem_free_security =            selinux_sem_free_security,
5694         .sem_associate =                selinux_sem_associate,
5695         .sem_semctl =                   selinux_sem_semctl,
5696         .sem_semop =                    selinux_sem_semop,
5697
5698         .d_instantiate =                selinux_d_instantiate,
5699
5700         .getprocattr =                  selinux_getprocattr,
5701         .setprocattr =                  selinux_setprocattr,
5702
5703         .secid_to_secctx =              selinux_secid_to_secctx,
5704         .secctx_to_secid =              selinux_secctx_to_secid,
5705         .release_secctx =               selinux_release_secctx,
5706         .inode_notifysecctx =           selinux_inode_notifysecctx,
5707         .inode_setsecctx =              selinux_inode_setsecctx,
5708         .inode_getsecctx =              selinux_inode_getsecctx,
5709
5710         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5711         .unix_may_send =                selinux_socket_unix_may_send,
5712
5713         .socket_create =                selinux_socket_create,
5714         .socket_post_create =           selinux_socket_post_create,
5715         .socket_bind =                  selinux_socket_bind,
5716         .socket_connect =               selinux_socket_connect,
5717         .socket_listen =                selinux_socket_listen,
5718         .socket_accept =                selinux_socket_accept,
5719         .socket_sendmsg =               selinux_socket_sendmsg,
5720         .socket_recvmsg =               selinux_socket_recvmsg,
5721         .socket_getsockname =           selinux_socket_getsockname,
5722         .socket_getpeername =           selinux_socket_getpeername,
5723         .socket_getsockopt =            selinux_socket_getsockopt,
5724         .socket_setsockopt =            selinux_socket_setsockopt,
5725         .socket_shutdown =              selinux_socket_shutdown,
5726         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5727         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5728         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5729         .sk_alloc_security =            selinux_sk_alloc_security,
5730         .sk_free_security =             selinux_sk_free_security,
5731         .sk_clone_security =            selinux_sk_clone_security,
5732         .sk_getsecid =                  selinux_sk_getsecid,
5733         .sock_graft =                   selinux_sock_graft,
5734         .inet_conn_request =            selinux_inet_conn_request,
5735         .inet_csk_clone =               selinux_inet_csk_clone,
5736         .inet_conn_established =        selinux_inet_conn_established,
5737         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5738         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5739         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5740         .req_classify_flow =            selinux_req_classify_flow,
5741         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5742         .tun_dev_free_security =        selinux_tun_dev_free_security,
5743         .tun_dev_create =               selinux_tun_dev_create,
5744         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5745         .tun_dev_attach =               selinux_tun_dev_attach,
5746         .tun_dev_open =                 selinux_tun_dev_open,
5747         .skb_owned_by =                 selinux_skb_owned_by,
5748
5749 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5750         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5751         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5752         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5753         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5754         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5755         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5756         .xfrm_state_free_security =     selinux_xfrm_state_free,
5757         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5758         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5759         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5760         .xfrm_decode_session =          selinux_xfrm_decode_session,
5761 #endif
5762
5763 #ifdef CONFIG_KEYS
5764         .key_alloc =                    selinux_key_alloc,
5765         .key_free =                     selinux_key_free,
5766         .key_permission =               selinux_key_permission,
5767         .key_getsecurity =              selinux_key_getsecurity,
5768 #endif
5769
5770 #ifdef CONFIG_AUDIT
5771         .audit_rule_init =              selinux_audit_rule_init,
5772         .audit_rule_known =             selinux_audit_rule_known,
5773         .audit_rule_match =             selinux_audit_rule_match,
5774         .audit_rule_free =              selinux_audit_rule_free,
5775 #endif
5776 };
5777
5778 static __init int selinux_init(void)
5779 {
5780         if (!security_module_enable(&selinux_ops)) {
5781                 selinux_enabled = 0;
5782                 return 0;
5783         }
5784
5785         if (!selinux_enabled) {
5786                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5787                 return 0;
5788         }
5789
5790         printk(KERN_INFO "SELinux:  Initializing.\n");
5791
5792         /* Set the security state for the initial task. */
5793         cred_init_security();
5794
5795         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5796
5797         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5798                                             sizeof(struct inode_security_struct),
5799                                             0, SLAB_PANIC, NULL);
5800         avc_init();
5801
5802         if (register_security(&selinux_ops))
5803                 panic("SELinux: Unable to register with kernel.\n");
5804
5805         if (selinux_enforcing)
5806                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5807         else
5808                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5809
5810         return 0;
5811 }
5812
5813 static void delayed_superblock_init(struct super_block *sb, void *unused)
5814 {
5815         superblock_doinit(sb, NULL);
5816 }
5817
5818 void selinux_complete_init(void)
5819 {
5820         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5821
5822         /* Set up any superblocks initialized prior to the policy load. */
5823         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5824         iterate_supers(delayed_superblock_init, NULL);
5825 }
5826
5827 /* SELinux requires early initialization in order to label
5828    all processes and objects when they are created. */
5829 security_initcall(selinux_init);
5830
5831 #if defined(CONFIG_NETFILTER)
5832
5833 static struct nf_hook_ops selinux_ipv4_ops[] = {
5834         {
5835                 .hook =         selinux_ipv4_postroute,
5836                 .owner =        THIS_MODULE,
5837                 .pf =           NFPROTO_IPV4,
5838                 .hooknum =      NF_INET_POST_ROUTING,
5839                 .priority =     NF_IP_PRI_SELINUX_LAST,
5840         },
5841         {
5842                 .hook =         selinux_ipv4_forward,
5843                 .owner =        THIS_MODULE,
5844                 .pf =           NFPROTO_IPV4,
5845                 .hooknum =      NF_INET_FORWARD,
5846                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5847         },
5848         {
5849                 .hook =         selinux_ipv4_output,
5850                 .owner =        THIS_MODULE,
5851                 .pf =           NFPROTO_IPV4,
5852                 .hooknum =      NF_INET_LOCAL_OUT,
5853                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5854         }
5855 };
5856
5857 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5858
5859 static struct nf_hook_ops selinux_ipv6_ops[] = {
5860         {
5861                 .hook =         selinux_ipv6_postroute,
5862                 .owner =        THIS_MODULE,
5863                 .pf =           NFPROTO_IPV6,
5864                 .hooknum =      NF_INET_POST_ROUTING,
5865                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5866         },
5867         {
5868                 .hook =         selinux_ipv6_forward,
5869                 .owner =        THIS_MODULE,
5870                 .pf =           NFPROTO_IPV6,
5871                 .hooknum =      NF_INET_FORWARD,
5872                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5873         }
5874 };
5875
5876 #endif  /* IPV6 */
5877
5878 static int __init selinux_nf_ip_init(void)
5879 {
5880         int err = 0;
5881
5882         if (!selinux_enabled)
5883                 goto out;
5884
5885         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5886
5887         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5888         if (err)
5889                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5890
5891 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5892         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5893         if (err)
5894                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5895 #endif  /* IPV6 */
5896
5897 out:
5898         return err;
5899 }
5900
5901 __initcall(selinux_nf_ip_init);
5902
5903 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5904 static void selinux_nf_ip_exit(void)
5905 {
5906         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5907
5908         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5909 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5910         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5911 #endif  /* IPV6 */
5912 }
5913 #endif
5914
5915 #else /* CONFIG_NETFILTER */
5916
5917 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5918 #define selinux_nf_ip_exit()
5919 #endif
5920
5921 #endif /* CONFIG_NETFILTER */
5922
5923 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5924 static int selinux_disabled;
5925
5926 int selinux_disable(void)
5927 {
5928         if (ss_initialized) {
5929                 /* Not permitted after initial policy load. */
5930                 return -EINVAL;
5931         }
5932
5933         if (selinux_disabled) {
5934                 /* Only do this once. */
5935                 return -EINVAL;
5936         }
5937
5938         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5939
5940         selinux_disabled = 1;
5941         selinux_enabled = 0;
5942
5943         reset_security_ops();
5944
5945         /* Try to destroy the avc node cache */
5946         avc_disable();
5947
5948         /* Unregister netfilter hooks. */
5949         selinux_nf_ip_exit();
5950
5951         /* Unregister selinuxfs. */
5952         exit_sel_fs();
5953
5954         return 0;
5955 }
5956 #endif